eFront - exploit.company

vendor:

eFront

by:

Pepelux

7.5

CVSS

HIGH

Remote File Inclusion

CWE

Product Name: eFront

Affected Version From: 3.5.2001

Affected Version To: 3.5.2001

Patch Exists: YES

Related CWE: N/A

CPE: a:efront:efront:3.5.1

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

eFront <= 3.5.1 / build 2710: Remote File Inclusion Vulnerability

Students and teachers can upload a shell.php as the avatar and next execute it as http://site/upload/student/avatars/shell.php or http://site/upload/professor/avatars/shell.php. In all sites tested, the upload directory is accessible by web.

Mitigation:

Ensure that the file upload feature is properly configured to only allow certain file types and extensions.

Source

Exploit-DB raw data:

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
eFront <= 3.5.1 / build 2710: Remote File Inclusion Vulnerability
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

$ Program: eFront
$ File affected: studentpage.php / professorpage
$ Version: 3.5.1 / build 2710
$ Download: http://www.efrontlearning.net


Found by Pepelux <pepelux[at]enye-sec.org>
eNYe-Sec - www.enye-sec.org

-- Description (by the author's page) --
eFront is an easy to use, visually attractive, SCORM compatible, eLearning
and Human Capital Development system. It is suitable for both company and
educational usage. The core eFront system is offered as open-source software
so you can download and start using it immediately. Check the functionality
matrix for different eFront editions.


-- Bug --
If you are a student or a teacher you can upload an avatar. It not check the
extension (JPG, PNG, GIF, ...) and you can upload any file (ex: PHP)

Website structure:

site.com /
         /upload/       		-> Files saved
		/admin/
                      /avatars
                /student/
                        /avatars
                /professor/
                          /avatars
         /www				-> Website
	 /backups
         /libraries


-- Exploit --
Students can upload a shell.php as the avatar ant next execute as:
  http://site/upload/student/avatars/shell.php

Teachers can upload a shell.php as the avatar ant next execute as:
  http://site/upload/professor/avatars/shell.php


Note: in all sites I've tested upload dorectory is accesible by web

# milw0rm.com [2008-09-30]