Online Ordering System By janobe - Arbitrary File Upload Vulnerability

Exploit Author： zerrr0

Vendor Homepage

https://www.sourcecodester.com/php/12978/online-ordering-system-phpmysqli.html

Description

An arbitrary file upload vulnerability in the select attachment function of Online Ordering System By janobe allows attackers to execute arbitrary code via a malicious PHP file.
Vulnerability file: /ordering/admin/products/controller.php?action=add

Proof of Concept (PoC) :

Goto: http://localhost/ordering/admin/
Login as admin using test credentials: admin/admin
Goto: http://localhost/ordering/admin/products/
Register New Product -> Upload Attachment