OneFileCMS - Failure to Restrict URL Access

vendor:

OneFileCMS

by:

Abhi M Balakrishnan

7,5

CVSS

HIGH

Failure to Restrict URL Access

287

CWE

Product Name: OneFileCMS

Affected Version From: upto 1.1.4

Affected Version To: upto 1.1.4

Patch Exists: YES

Related CWE: N/A

CPE: 2.3:a:rocktronica:onefilecms

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Apache-2.2.17, PHP-5.2.17, MySQL-5.5.9, Windows 6.2

2012

OneFileCMS – Failure to Restrict URL Access

By creating a rule in No-Redirect Add-on: ^http://example.com/path/ and accessing http://example.com/path/admin.php, the redirection mechanism can be bypassed easily.

Mitigation:

Upgrade to version 1.1.5 or later.

Source

Exploit-DB raw data:

# Exploit Title: OneFileCMS - Failure to Restrict URL Access
# Date: 12th March 2012
# Author: Abhi M Balakrishnan
# Software Link: https://raw.github.com/rocktronica/OneFileCMS/f265961d0646890c9efe05b93983124abc18c56e/onefilecms.php
# Version: upto 1.1.4
# Tested on: Apache-2.2.17, PHP-5.2.17, MySQL-5.5.9, Windows 6.2
# Vulnerability Status: Fixed on version 1.1.5.	Developer was very quick in responding to mails and to fix the issue. Bugfix version released within minutes after the notification. Great work.!!!
	Commit: https://github.com/rocktronica/OneFileCMS/commit/a4e36213d9fe3efccc2f6730d29fd2a05c57594b

# Vulnerability: Failure to Restrict URL Access, since the redirection mechanism can be bypassed easily

# Exploit:

	Step 1:	Create a rule in No-Redirect Add-on: ^http://example.com/path/
	Step 2:	Access http://example.com/path/admin.php

# PoC Video: http://www.youtube.com/watch?v=0lPz24Z7Q_4