Path Traversal in BlackCat CMS

High-Tech Bridge Security Research Lab discovered vulnerability in BlackCat CMS, which can be exploited to view contents of arbitrary files on the local system. An attacker might be able to obtain potentially sensitive or system information, and even compromise the vulnerable system.

The vulnerability exists due to improper validation of file path in “dl” HTTP GET parameter, when reading local files using “/modules/blackcat/widgets/logs.php” script. A remote unauthenticated attacker can download arbitrary files from the vulnerable system using directory traversal sequences (“…/”).

A simple exploit below allows download of “config.php” file:

http://host/modules/blackcat/widgets/logs.php?dl=/../config.php