ID:1508 - Exploit for Code Injection in Totaljs CMS - CVE-2019-15954

Link to public exploit:

Vulnerability description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation in widget creation. A remote authenticated user with “widgets” privilege can send a malicious widget with a special tag containing JavaScript code that will be evaluated server side and execute arbitrary code on the target system. In the process of evaluating the tag by back-end is possible to escape the sandbox object by using the following payload:

<script
total>global.process.mainModule.require(‘child_process’).exec(‘RCE here’);

</script>

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Remediation