Wolf CMS – Arbitrary File Upload / Execution
# Exploit Title : Wolf CMS 0.8.2 Arbitrary File Upload To Command Execution # Reported Date : 05-May-2015 # Fixed Date : 10-August-2015 # Exploit Author : Narendra Bhati # CVE ID : CVE-2015-6567 , CVE-2015-6568 # Contact: * Facebook : https://facebook.com/narendradewsoft *Twitter : http://twitter.com/NarendraBhatiB # Website : http://websecgeeks.com # Additional Links - * https://github.com/wolfcms/wolfcms/releases/ * https://www.wolfcms.org/blog/2015/08/10/releasing-wolf-cms-0-8-3-1.html #For POC - http://websecgeeks.com/wolf-cms-arbitrary-file-upload-to-command-execution/ 1. Description Every registered users who have access of upload functionality can upload an Arbitrary File Upload To perform Command Execution Vulnerable URL http://targetsite.com/wolfcms/?/admin/plugin/file_manager/browse/ Vulnerable Parameter "filename" 2. Proof of Concept A)Login as regular user ( who have access upload functionality ) B)Go to this page - http://targetsite.com/wolfcms/?/admin/plugin/file_manager/browse/ C)Select upload an file option to upload Arbitary File ( filename ex: "hello.php" ) D)Now you can access the file by here - http://targetsite.com/wolfcms/public/hello.php 3. Solution: Update to version 0.8.3.1 http://www.wolfcms.org/download.html ============= -- *Narendra Bhati "CEH" **( Facebook <http://www.facebook.com/narendradewsoft> , Twitter <http://www.twitter.com/NarendraBhatiB> , LinkedIn <https://www.linkedin.com/profile/view?id=115146074> , Personal Blog )* *Security Analyst - IT Risk & Security Management Services* Suma Soft Pvt. Ltd. | Suma Center | Near Mangeshkar Hospital | Erandawane Pune: 411004 | *======================================================================* |