########################## WwW.BugReport.ir
###########################################
#
# AmnPardaz Security Research & Penetration Testing Group
#
# Title: CMME Multiple Information disclosure vulnerabilities
# Vendor: http://cmme.oesterholt.net
# Bug: Information Disclosure
# Vulnerable Version: 1.19 (prior versions also may be affected)
# Exploitation: Remote with browser
# Exploit: Available
# Fix Available: No!
# Original Advisory: http://www.bugreport.ir/index_55.htm
########################################################################
###########
####################
- Description:
####################
Quote from vendor: CMME means "Content Management Made Easy". It is a
web content management system that is easy to use, doesn't have a lot
of requirements
and allows for reasonable flexibility.
####################
- Vulnerability:
####################
There are multiple vulnerabilities in CMME , which can be exploited by
malicious people to disclose potentially sensitive information.
these can be exploited to read the contents of data files on the
server via a specially crafted URL, without requiring a valid login.
+-->Users Information Disclosure (Including MD5 Hashes)
POC: http://example.com/cmme/data/admin/users
+-->Server Informaion (phpinfo)
POC: http://example.com/cmme/info.php
+-->The Last generated server backup
POC: http://example.com/cmme/backup/cmme_data.zip
####################
- Solution:
####################
Restrict and grant only trusted users access to the resources.
####################
- Credit :
####################
AmnPardaz Security Research & Penetration Testing Group
Contact: admin[4t}bugreport{d0t]ir
WwW.BugReport.ir
WwW.AmnPardaz.com
