chillyCMS 1.3.0 Multiple Vulnerabilities

2013.02.15
Credit: Abhi M
Risk: Medium
Local: No
Remote: Yes
CVE: N/A
CWE: N/A

# Vulnerability Failure to Restrict URL Access chillyCMS uses 302 redirects to restrict access to the unautorized pages. # Exploit Step 1: Create a rule in No-Redirect Add-on: ^http://localhost/chillyCMS/ Step 2: Access http://localhost/chillyCMS/admin/ # Vulnerability Arbitrary File Upload chillyCMS/admin/design.site.php page extracts all uploaded ZIP files to chillyCMS/tmp directory # Exploit Step 1: Create a ZIP file of the files to be uploaded. Example: Compress shell.php to get shell.zip Step 2: Upload shell.zip Step 3: Access the shell at http://localhost/chillyCMS/tmp/shell.php # History 11 March 2012 - Discovered vulnerability and exploit, contacted the vendor. 12 March 2012 - Vendor responds back, exchanges few mails. 15 November 2012 - Vendor discontinues further development. 15 February 2013 - Published the vulnerabilities and exploits to the public. # How to reproduce The latest download from the website was not working on fresh install. An earlier version (1.1.3) has been installed and all the PHP files, except config.php, have been replaced with new files.


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2018, cxsecurity.com

 

Back to Top