Exponentcms Exponent CMS

Bug description

Exponent CMS 2.6.0 patch2 allows an authenticated admin user to upload a malicious extension in the format of a zip file with a php file inside it.
After uploaded it, the php file will be placed at themes/simpletheme/{rce}.php from where can be accessed to execute commands.

CVSSv3 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CVSSv3 Base Score: 9.1

Steps to reproduce

1. Click on the Exponent logo located on the upper left corner.
   
2. Go to 'Super-Admin Tools' > 'Extensions' > 'Install Extension'.
   
3. Click on 'Upload Extension'.
   
4. Create a malicious PHP file with the following PoC.

<?php echo system($_GET['cmd']); ?>

1. Zip the php file.
   
2. Upload the zip file.
   
3. Click on 'Upload Extension'
   
4. Next, click on 'Continue with Installation'.
   
5. Go to http://127.0.0.1/exponentcms/themes/simpletheme/{rce}.php in order to execute commands

Attached below are the links to the advisory and our responsible disclosure policy.

• https://fluidattacks.com/advisories/dylan/
• https://fluidattacks.com/advisories/policy

System Information

• Version: Exponent CMS 2.6.0 patch2.
• Operating System: Linux.
• Web Server: Apache
• PHP Version: 7.4
• Database and version: Mysql