LotusCMS 3.0 - Remote Code Execution

What is the "LotusCMS 3.0 - Remote Code Execution?" module?

The "LotusCMS 3.0 - Remote Code Execution" module is designed to detect a critical vulnerability in LotusCMS 3.0, a specific software. This vulnerability allows remote attackers to execute arbitrary code on the target system. The severity of this vulnerability is classified as critical, indicating the potential for significant damage if exploited. The original author of this module is pikpikcu.

Impact

If successfully exploited, this vulnerability can lead to remote code execution on the target system. Attackers can inject malicious PHP code into the 'page' parameter, which will be passed to an eval function. This can result in unauthorized access, data theft, or complete compromise of the affected system.

How does the module work?

The module sends HTTP requests to specific paths ("/index.php" and "/lcms/index.php") using the POST method. The request headers include the "Content-Type" set to "application/x-www-form-urlencoded". The module then applies matching conditions to determine if the vulnerability exists.

The matching conditions include:

- Checking if the response body contains the specific word "38ee63071a04dc5e04ed22624c38e648". - Verifying that the response status is 200 (OK).

If both conditions are met, the module reports the vulnerability.