Exploit the possiblities

JGI CMS 1.0 Directory Traversal

JGI CMS 1.0 Directory Traversal
Posted Sep 11, 2017
Authored by Renzi

JGI CMS version 1.0 suffers from a directory traversal vulnerability.

tags | exploit, file inclusion
MD5 | be892befef82a66cb3a045ec3df6749a

JGI CMS 1.0 Directory Traversal

Change Mirror Download
Title:
=======
JGI CMS - Directory Traversal

Introduction:
==============
A content management system (CMS) is a computer application that supports the creation and modification of digital content.
It is often used to support multiple users working in a collaborative environment.
CMS features vary widely. Most CMSs include Web-based publishing, format management, history editing and version control, indexing, search, and retrieval.
By their nature, content management systems support the separation of content and presentation.

Vulnerability Disclosure:
==========================
2017-09-10: Public Disclosure

Affected Product(s):
=====================
JGI CMS 1.0

Exploitation Technique:
========================
Remote

Severity Level:
================
High

Technical Details & Description:
=================================
A Directory Traversal vulnerability has been discovered in the JCI CMS web-application.
The vulnerability is located in the 'arquivo' parameter of the`dl.php` action GET method request.

Request Method(s):

[+] GET

Vulnerable Function(s):

[+] dl.php

Vulnerable Parameter(s):

[+] arquivo

Proof of Concept (PoC):
========================
A path traversal attack (also known as directory traversal) aims to access files and directories that are stored outside the web root folder.
By manipulating variables that reference files with adot-dot-slash (../)a sequences and its variations or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system including application source code or configuration and critical system files.
It should be noted that access to files is limited by system operational access control. [OWASP]

[+] http://www.abq.org.br/dl.php?arquivo=../../../../../../../../../../etc/passwd

Solution
=========
There are several measures that enterprises can take to prevent directory traversal attacks and vulnerabilities.
For starters, programmers should be trained to validate user input from browsers.
Input validation ensures that attackers cannot use commands that leave the root directory or violate other access privileges.
Beyond this, filters can be used to block certain user input.
Enterprises typically employ filters to block URLs containing commands and escape codes that are commonly used by attackers.
Additionally, web server software (and any software that is used) should be kept up-to-date with current patches.
Regularly patching software is a critical practice for reducing security risk, as software patches typically contain security fixes. [Veracode]

Credits
========
Felipe "Renzi" Gabriel

Contact
========
renzi@linuxmail.org

References
==========
https://www.owasp.org/index.php/Path_Traversal
https://www.veracode.com/security/directory-traversal
https://en.wikipedia.org/wiki/Content_management_system

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

Want To Donate?


Bitcoin: 18PFeCVLwpmaBuQqd5xAYZ8bZdvbyEWMmU

File Archive:

February 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Feb 1st
    15 Files
  • 2
    Feb 2nd
    15 Files
  • 3
    Feb 3rd
    15 Files
  • 4
    Feb 4th
    13 Files
  • 5
    Feb 5th
    16 Files
  • 6
    Feb 6th
    15 Files
  • 7
    Feb 7th
    15 Files
  • 8
    Feb 8th
    15 Files
  • 9
    Feb 9th
    18 Files
  • 10
    Feb 10th
    8 Files
  • 11
    Feb 11th
    8 Files
  • 12
    Feb 12th
    17 Files
  • 13
    Feb 13th
    15 Files
  • 14
    Feb 14th
    15 Files
  • 15
    Feb 15th
    17 Files
  • 16
    Feb 16th
    18 Files
  • 17
    Feb 17th
    37 Files
  • 18
    Feb 18th
    2 Files
  • 19
    Feb 19th
    11 Files
  • 20
    Feb 20th
    0 Files
  • 21
    Feb 21st
    0 Files
  • 22
    Feb 22nd
    0 Files
  • 23
    Feb 23rd
    0 Files
  • 24
    Feb 24th
    0 Files
  • 25
    Feb 25th
    0 Files
  • 26
    Feb 26th
    0 Files
  • 27
    Feb 27th
    0 Files
  • 28
    Feb 28th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2018 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close