[FD] MeshCMS Command Execution Vulnerability

############# Exploit Title: MeshCMS 3.6 – Command Execution Vulnerability Date: 2016-04-03 Exploit Author: piaox xiong Vendor Homepage: http://ift.tt/1XcWcYd Software Link: http://ift.tt/1qqj38h Version: 3.6 Tested on: Windows OS ############# Application Description: MeshCMS is an online editing system written in Java. It provides a set of features usually included in a CMS, but it uses a more traditional approach: pages are stored in regular HTML files and all additional features are file-based, without needing a database. ############# Vulnerability Description: in the staticexport2.jsp jspfile,the parameter “exportCommand” cause Command Execution. if (!exportCommand.equals("")) { out.println("\nexecuting: " + exportCommand); Process process = Runtime.getRuntime().exec(exportCommand); out.println("standard output:"); ByteArrayOutputStream baos = new ByteArrayOutputStream(); Utils.copyStream(process.getInputStream(), baos, false); out.write(Utils.encodeHTML(baos.toString())); baos.reset(); out.println("end of standard output\nerror output:"); Utils.copyStream(process.getErrorStream(), baos, false); out.write(Utils.encodeHTML(baos.toString())); int exit = process.waitFor(); out.println("end of error output\nexecution finished with exit code " + exit); POC: http://ift.tt/1XcWcYj [image: 内嵌图片 1]

Source: Gmail -> IFTTT-> Blogger