Frog CMS 0.9.5 – Arbitrary File Upload
Exploit Title: Arbitrary File Upload in Frog CMS 0.9.5 Date : 2014-07-07 Exploit Author : Javid Hussain Vendor Homepage : http://www.madebyfrog.com # Exploit-DB Note: All authenticated users can upload files. If the file # does not have execute permissions the CMS allows users to change them. # No need to be authenticated to trigger uploaded files. There is a possibility to upload arbitrary file in Frog CMS latest version 0.9.5 POC: The vulnerability exist because of the filemanager plugin is not properly verifying the extension of uploaded files. Go to http://localhost/frog_095/admin/?/plugin/file_manager/images Upload an executable php file Go to http://localhost/Frog/frog_095/public/images/ for verification. |