Remote Code Execution in Exponent

ID HTB23290
Type htbridge
Reporter High-Tech Bridge
Modified 2016-02-01T00:00:00


High-Tech Bridge Security Research Lab discovered critical vulnerability in Exponent CMS, which can be exploited to inject and execute arbitrary PHP code on the vulnerable system with the privileges of the web server.

The vulnerability resides within "/install/index.php" script, when handling user-input data passed via "sc" HTTP POST parameter. The script is not deleted by default after installation of the web application. A remote unauthenticated attacker can permanently inject arbitrary PHP code into "/framework/conf/config.php" configuration file and execute it with privileges of the web server.

The attacker will be able to run arbitrary system commands, gain complete control over the vulnerable website, its databases and even compromise the entire web server.

A simple exploit below will modify "/framework/conf/config.php" file and inject simple web shell into it:

<form action="http://[host]/install/index.php" method="post" name="main">
<input type="hidden" name='sc[",""); passthru($_GET[]' value='"]); // '>
<input value="submit" id="btn" type="submit" />

After successful PHP code injection, the attacker can execute arbitrary system command viathe web shell.

The following example will display output of "/bin/ls" command for the current directory: