vendor:
MeshCMS
by:
mr_me
8.8
CVSS
HIGH
CSRF vulnerability
352
CWE
Product Name: MeshCMS
Affected Version From: 3.5
Affected Version To: 3.5
Patch Exists: YES
Related CWE: N/A
CPE: a:meshcms:meshcms:3.5
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: Tomcat 7.02/ubuntu 10.04
2010
MeshCMS v3.5 remote code execution exploit
There is a add member/editor/admin CSRF vulnerability in this CMS which is very clean for an attacker. The admin will not be told a user has been added and will land into the admin console without any other suspicion. Additionally, the user cannot be simply deleted. Access to the filesystem is required to remove the private/[username].xml config file required for the users authentication. The CMS actually allows users to execute a command when they backup the website files to an arbitary location on the server. This is simply a design flaw and it doesn't matter if you are a member, editor or admin. You can execute code.
Mitigation:
Ensure that the CMS is updated to the latest version and that all users are aware of the risks associated with CSRF vulnerabilities.
