CVE-2023-43352-CMSmadesimple-SSTI--Content — SSTI vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to use native template syntax to inject a malicious payload into a template, which is then executed server-side | Kitploit

CMSmadesimple SSTI v2.2.18

Author: (Sergio)

Description: Server Side Template Injection (SSTI) vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to use native template syntax to inject a malicious payload into a template, which is then executed server-side.

Attack Vectors: A SSTI vulnerability in the sanitization of the entry in the Content of "Content - Content Manager Menu" allows injecting a malicious payload into a template code that will be executed when the user accesses the web page.

POC:

When logging into the panel, we will go to the "Content Manager- Title" section off Content Menu.

SSTI Payload

We edit that Content field with a template malicious payload.

SSTI Payload:

{{4*4}}

In the following image you can see the embedded code that executes the payload in the main web.

SSTI Resultado

We identify the technology used with the following payload.

SSTI Payload:

a{*comment*}b

Smarty Test payload

And the result is the following:

Smarty Test resultado

Since the payload has worked we know that it uses Smarty, then we obtain the Smarty version with the following payload:

SSTI Payload:

{$smarty.version}

Smarty version payload

And in the result we can see the version of Smarty using the SSTI:

Smarty version resultado

We can also use the following payload to see the server name variable:

SSTI Payload:

{$smarty.server.SERVER_NAME}

Smarty Server Name payload

Below is the result of the SSTI payload with the server name:

Smarty Server Name resultado

Additional Information:

http://www.cmsmadesimple.org/

https://owasp.org/Top10/es/A03_2021-Injection/