CVE-2024-33438 PoC — Devellion CubeCart 安全漏洞

Source

https://github.com/julio-cfa/CVE-2024-33438

Associated Vulnerability

Title:Devellion CubeCart 安全漏洞 (CVE-2024-33438)
Description:Devellion CubeCart是英国Devellion公司的公司的一套免费且开源的电子商务购物车软件。该软件支持在网上商店销售产品、添加/编辑产品或图像等。 Devellion CubeCart 6.5.5之前版本存在安全漏洞，该漏洞源于允许经过身份验证的用户执行任意代码。

Description

CubeCart <= 6.5.4 is vulnerable to an arbitrary file upload that leads to remote code execution (RCE).

Readme

# Arbitrary File Upload Leads to RCE (CVE-2024-33438)
CubeCart &lt;= 6.5.4 is vulnerable to an arbitrary file upload issue that leads to remote code execution (RCE). The vulnerability affects the application's file manager and its filters by allowing attackers to upload `.phar` files containing malicious code. CubeCart should be updated to 6.5.5 as it implements a security patch to fix this vulnerability.

For more details, please see the official announcement by CubeCart in the references.

## Exploit
An automated proof-of-concept (PoC) has been created, but this vulnerability can also be exploited manually by uploading a malicious `.phar` file via the file manager.

This is the usage of the PoC:
```
Usage: python3 CubeCartCVE.py <URL> <username> <password> <command>
```

After running it, this is the expected output for a successful exploitation:
```
python3 CubeCartCVE.py http://localhost/admin_0Kqnr9.php admin 123456 whoami

     []  ,----.___
   __||_/___      '.
  / O||    /|
 /   ""   / /
/________/ /   launching exploit
|________|/    please wait...

[+] Trying to log into the application...
[+] Successful login. Uploading a simple web shell to the server...
[+] Executing command...

Output: www-data
```

## References

* https://forums.cubecart.com/topic/59046-cubecart-655-released-minor-security-update/
* https://github.com/cubecart/v6/issues/3570
* https://github.com/cubecart/v6/commit/31a5ec39b0924b2111fbc3aa419bd8c5c3fc1841
* https://www.cve.org/CVERecord?id=CVE-2024-33438
* http://blog.cat22.io/blog/cve/cve-2024-33438.html

File Snapshot


 [4.0K]  /data/pocs/ce099420d25322d063d70d3a1117e96d6dd7ecf5
├── [2.8K]  CubeCart-CVE-2024-33438.py
└── [1.5K]  README.md

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!