vendor:
TextPattern CMS
by:
Mert Daş
8,8
CVSS
HIGH
Remote Command Execution
78
CWE
Product Name: TextPattern CMS
Affected Version From: 4.8.7
Affected Version To: 4.8.7
Patch Exists: YES
Related CWE: N/A
CPE: a:textpattern:textpattern:4.8.7
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: Xampp
2021
TextPattern CMS 4.8.7 – Remote Command Execution (Authenticated)
First of all, an attacker should use the file upload section to upload a malicious shell containing the code <?PHP system($_GET['cmd']);?>. Then, the attacker should go to the content section, click Files and upload the malicious php file. Finally, the attacker should go to the URL of the malicious file with the command as a parameter (e.g. yourserver/textpattern/files/yourphp.php?cmd=yourcode). After the request is sent, the response will contain the output of the command.
Mitigation:
To mitigate this vulnerability, users should ensure that they are running the latest version of TextPattern CMS and that they have implemented proper access control mechanisms.
