critical9.9Public exploit code
CVE-2019-15954
An issue was discovered in Total.js CMS 12.0.0.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Total.js CMS 12 - Widget JavaScript Code Injection (Metasploit)2019-10-22 · remote · multiple · Verified
Impact
An issue was discovered in Total.js CMS 12.0.0. An authenticated user with the widgets privilege can gain achieve Remote Command Execution (RCE) on the remote server by creating a malicious widget with a special tag containing JavaScript code that will be evaluated server side. In the process of evaluating the tag by the back-end, it is possible to escape the sandbox object by using the following payload: <script total>global.process.mainModule.require(child_process).exec(RCE);</script>
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Totaljs | Total.Js Cms | Version 12.0.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/154924/Total.js-CMS-12-Widget-JavaScript-Code-Injection.html
- https://github.com/beerpwn/CVE/blob/master/Totaljs_disclosure_report/report_final.pdf
- https://seclists.org/fulldisclosure/2019/Sep/5
- http://packetstormsecurity.com/files/154924/Total.js-CMS-12-Widget-JavaScript-Code-Injection.html
- https://github.com/beerpwn/CVE/blob/master/Totaljs_disclosure_report/report_final.pdf
- https://seclists.org/fulldisclosure/2019/Sep/5