vendor:
u5CMS
by:
Gjoko 'LiquidWorm' Krstic
7.5
CVSS
HIGH
Local File Inclusion
22
CWE
Product Name: u5CMS
Affected Version From: 3.9.2002
Affected Version To: 3.9.2003
Patch Exists: YES
Related CWE: N/A
CPE: a:stefan_p_minder:u5cms
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: Apache 2.4.10 (Win32), PHP 5.6.3, MySQL 5.6.21
2015
u5CMS 3.9.3 (thumb.php) Local File Inclusion Vulnerability
u5CMS suffers from an authenticated file inclusion vulnerability (LFI) when input passed thru the 'f' parameter to thumb.php script is not properly verified before being used to include files. This can be exploited to include files from local resources with their absolute path and with directory traversal attacks.
Mitigation:
Input validation should be performed to prevent the exploitation of this vulnerability.
