CVE-2023-36212
📋 TL;DR
CVE-2023-36212 is a file upload vulnerability in Total CMS v1.7.4 that allows remote attackers to upload crafted PHP files through the edit page function, leading to arbitrary code execution. This affects all systems running Total CMS v1.7.4 with the vulnerable edit page functionality enabled. Attackers can gain complete control of affected web servers.
💻 Affected Systems
- Total CMS
📦 What is this software?
Total Cms by Totalcms
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise with attacker gaining root/admin access, data exfiltration, ransomware deployment, and use as pivot point for lateral movement.
Likely Case
Webshell upload leading to website defacement, data theft, and backdoor persistence on the server.
If Mitigated
Attack blocked at WAF/web application firewall level with file upload restrictions preventing PHP execution.
🎯 Exploit Status
Multiple public exploits available requiring authentication to the edit page. Exploitation is straightforward once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version if available, or implement workarounds.
🔧 Temporary Workarounds
Restrict PHP File Uploads
allConfigure web server to block PHP file uploads or execution from upload directories
# For Apache: Add to .htaccess in upload directory
<Files *.php>
Order Deny,Allow
Deny from all
</Files>
# For Nginx: Add to server block
location ~* \.php$ {
deny all;
return 403;
}
Disable Edit Page Function
allRemove or disable the vulnerable edit page functionality
# Remove or rename the edit page file
mv /path/to/edit_page.php /path/to/edit_page.php.disabled
🧯 If You Can't Patch
- Implement strict file upload validation: only allow specific file types, validate file extensions, and scan uploaded files
- Deploy WAF rules to block PHP file uploads and monitor for exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check if running Total CMS v1.7.4 and if edit page functionality is accessibleCheck Version:
Check CMS configuration files or admin panel for version informationVerify Fix Applied:
Attempt to upload a PHP file through the edit page - should be blocked or fail📡 Detection & Monitoring
Log Indicators:
- PHP file uploads to edit page endpoint
- Unusual file uploads with .php extension
- Multiple failed upload attempts
Network Indicators:
- POST requests to edit page with file uploads
- Unusual outbound connections from web server
SIEM Query:
source="web_logs" AND (uri="/edit_page" OR uri="*edit*php") AND (method="POST" AND file_extension=".php")🔗 References
- https://github.com/capture0x/Total-CMS-EXPLOIT/
- https://packetstormsecurity.com/files/172687/Total-CMS-1.7.4-Shell-Upload.html
- https://www.exploit-db.com/exploits/51500
- https://github.com/capture0x/Total-CMS-EXPLOIT/
- https://packetstormsecurity.com/files/172687/Total-CMS-1.7.4-Shell-Upload.html
- https://www.exploit-db.com/exploits/51500
