Lighthouse has a new layout. Prefer the old one? Return to the old layout, and switch back any time from the link at the top of each page.

There was a problem

You must be a member of this account.

Exponent CMS 2.6.0 patch2 - Insecure file upload (RCE Upload new extension)

#1460

Bug description

Exponent CMS 2.6.0 patch2 allows an authenticated admin user to upload a malicious extension in the format of a zip file with a php file inside it.
After uploaded it, the php file will be placed at themes/simpletheme/{rce}.php from where can be accessed to execute commands.

CVSSv3 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CVSSv3 Base Score: 9.1

Steps to reproduce

  1. Click on the Exponent logo located on the upper left corner.
  2. Go to 'Super-Admin Tools' > 'Extensions' > 'Install Extension'.
  3. Click on 'Upload Extension'.
  4. Create a malicious PHP file with the following PoC.
<?php echo system($_GET['cmd']); ?>
  1. Zip the php file.
  2. Upload the zip file.
  3. Click on 'Upload Extension'
  4. Next, click on 'Continue with Installation'.
  5. Go to http://127.0.0.1/exponentcms/themes/simpletheme/{rce}.php in order to execute commands

Attached below are the links to the advisory and our responsible disclosure policy.

System Information

  • Version: Exponent CMS 2.6.0 patch2.
  • Operating System: Linux.
  • Web Server: Apache
  • PHP Version: 7.4
  • Database and version: Mysql

Reported by Oscar · January 24th, 2022 @ 05:32 PM

State: new
Milestone: none
Assigned to: dleffler dleffler

Activity

  1. Oscar
    Oscar

    Any functionality that allows functions/actions other than those planned are cases of abuse, regardless of the context (the impact is given by the rating). Abuse cases are usually vulnerabilities that need to be fixed.

    February 17th, 2022 @ 04:12 PM

Please Sign in or create a free account to add a new ticket.

With your very own profile, you can contribute to projects, track your activity, watch tickets, receive and update tickets through your email and much more.