Wolf CMS – Arbitrary File Upload / Execution

• Exploit Database
• 13 阅读

• 作者： Narendra Bhati
  日期： 2015-08-28
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/38000/

• # Exploit Title: Wolf CMS 0.8.2Arbitrary File Upload To Command
  Execution
  # Reported Date: 05-May-2015
  # Fixed Date : 10-August-2015
  # Exploit Author : Narendra Bhati
  # CVE ID : CVE-2015-6567 , CVE-2015-6568
  # Contact:
  * Facebook : https://facebook.com/narendradewsoft
  *Twitter : http://twitter.com/NarendraBhatiB
  # Website: http://websecgeeks.com
  # Additional Links -
  * https://github.com/wolfcms/wolfcms/releases/
  * https://www.wolfcms.org/blog/2015/08/10/releasing-wolf-cms-0-8-3-1.html
  
  #For POC -
  http://websecgeeks.com/wolf-cms-arbitrary-file-upload-to-command-execution/
  
  1. Description
  
  Every registered users who have access of upload functionality can upload
  an Arbitrary File Upload To perform Command Execution
  
  Vulnerable URL
  
  http://targetsite.com/wolfcms/?/admin/plugin/file_manager/browse/
  
  Vulnerable Parameter
  
  "filename"
  
  
  2. Proof of Concept
  
  A)Login as regular user ( who have access upload functionality )
  
  B)Go to this page-
  http://targetsite.com/wolfcms/?/admin/plugin/file_manager/browse/
  
  C)Select upload an file option to upload Arbitary File ( filename ex:
  "hello.php" )
  
  D)Now you can access the file by here -
  http://targetsite.com/wolfcms/public/hello.php
  
  
  3. Solution:
  
  Update to version 0.8.3.1
  http://www.wolfcms.org/download.html
  
  =============
  
  -- 
  *Narendra Bhati "CEH" **( Facebook
  <http://www.facebook.com/narendradewsoft> , Twitter
  <http://www.twitter.com/NarendraBhatiB> , LinkedIn
  <https://www.linkedin.com/profile/view?id=115146074> , Personal Blog )*
  *Security Analyst - IT Risk & Security Management Services*
  Suma Soft Pvt. Ltd. | Suma Center | Near Mangeshkar Hospital | Erandawane
  Pune: 411004 |
  
  *======================================================================*