redaxscript 2.5.0 - Multiple Vulnerabilities

ID 1337DAY-ID-24694
Type zdt
Reporter Tim Coen
Modified 2015-12-10T00:00:00


Exploit for php platform in category web applications

                                            redaxscript 2.5.0 - Multiple Vulnerabilities


The module file_manager allows for file uploads, and uses exif_imagetype to
check the validity of the file.

By setting the first bytes of the uploaded file to that of a valid image type,
an attacker can easily bypass this check and thus upload files of dangerous

It should be noted that only files with the name index.php will be executed, as
access to all other PHP files is forbidden by a htaccess file.

An account that has access to the module "File manager" is needed to exploit
this issue.


function file_manager_upload($directory = '')
        $file = $_FILES['file']['tmp_name'];
        $file_name = file_manager_clean_file_name($_FILES['file']['name']);
        $file_size = $_FILES['file']['size'];

        /* validate post */

        if (function_exists('exif_imagetype'))
                if (exif_imagetype($file) == '')
                        $error = l('file_type_limit', '_file_manager') . l('point');


To mitigate this issue please remove the file_manager module.


redaxscript 2.5.0 Cross Site Scripting


There is a persistent XSS vulnerability when leaving comments. It requires the
admin to hover over a link to trigger the injected code.

This issue can lead to the injection of JavaScript keyloggers, or the bypassing
of CSRF protection. In this case, this may lead to code execution.

The issue has been partially fixed in version 2.6.0. However, it was still
possible to inject a style attribute, making XSS in older browsers possible.
This has been fixed in version 2.6.1.

 Proof of Concept

1. Create a comment, as comment text use:
    comment" onmouseover=alert(1) foo="
2. In the sidebar, hover over the comment to trigger the XSS.


To mitigate this issue please upgrade at least to version 2.6.1:

Please note that a newer version might already be available.

# [2016-04-20]  #