Twenty Year Anniversary

JGI CMS 1.0 Directory Traversal

JGI CMS 1.0 Directory Traversal
Posted Sep 11, 2017
Authored by Renzi

JGI CMS version 1.0 suffers from a directory traversal vulnerability.

tags | exploit, file inclusion
MD5 | be892befef82a66cb3a045ec3df6749a

JGI CMS 1.0 Directory Traversal

Change Mirror Download
Title:
=======
JGI CMS - Directory Traversal

Introduction:
==============
A content management system (CMS) is a computer application that supports the creation and modification of digital content.
It is often used to support multiple users working in a collaborative environment.
CMS features vary widely. Most CMSs include Web-based publishing, format management, history editing and version control, indexing, search, and retrieval.
By their nature, content management systems support the separation of content and presentation.

Vulnerability Disclosure:
==========================
2017-09-10: Public Disclosure

Affected Product(s):
=====================
JGI CMS 1.0

Exploitation Technique:
========================
Remote

Severity Level:
================
High

Technical Details & Description:
=================================
A Directory Traversal vulnerability has been discovered in the JCI CMS web-application.
The vulnerability is located in the 'arquivo' parameter of the`dl.php` action GET method request.

Request Method(s):

[+] GET

Vulnerable Function(s):

[+] dl.php

Vulnerable Parameter(s):

[+] arquivo

Proof of Concept (PoC):
========================
A path traversal attack (also known as directory traversal) aims to access files and directories that are stored outside the web root folder.
By manipulating variables that reference files with adot-dot-slash (../)a sequences and its variations or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system including application source code or configuration and critical system files.
It should be noted that access to files is limited by system operational access control. [OWASP]

[+] http://www.abq.org.br/dl.php?arquivo=../../../../../../../../../../etc/passwd

Solution
=========
There are several measures that enterprises can take to prevent directory traversal attacks and vulnerabilities.
For starters, programmers should be trained to validate user input from browsers.
Input validation ensures that attackers cannot use commands that leave the root directory or violate other access privileges.
Beyond this, filters can be used to block certain user input.
Enterprises typically employ filters to block URLs containing commands and escape codes that are commonly used by attackers.
Additionally, web server software (and any software that is used) should be kept up-to-date with current patches.
Regularly patching software is a critical practice for reducing security risk, as software patches typically contain security fixes. [Veracode]

Credits
========
Felipe "Renzi" Gabriel

Contact
========
renzi@linuxmail.org

References
==========
https://www.owasp.org/index.php/Path_Traversal
https://www.veracode.com/security/directory-traversal
https://en.wikipedia.org/wiki/Content_management_system

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

Want To Donate?


Bitcoin: 18PFeCVLwpmaBuQqd5xAYZ8bZdvbyEWMmU

File Archive:

June 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jun 1st
    14 Files
  • 2
    Jun 2nd
    1 Files
  • 3
    Jun 3rd
    3 Files
  • 4
    Jun 4th
    18 Files
  • 5
    Jun 5th
    21 Files
  • 6
    Jun 6th
    8 Files
  • 7
    Jun 7th
    16 Files
  • 8
    Jun 8th
    18 Files
  • 9
    Jun 9th
    5 Files
  • 10
    Jun 10th
    2 Files
  • 11
    Jun 11th
    21 Files
  • 12
    Jun 12th
    32 Files
  • 13
    Jun 13th
    15 Files
  • 14
    Jun 14th
    16 Files
  • 15
    Jun 15th
    4 Files
  • 16
    Jun 16th
    1 Files
  • 17
    Jun 17th
    2 Files
  • 18
    Jun 18th
    15 Files
  • 19
    Jun 19th
    15 Files
  • 20
    Jun 20th
    8 Files
  • 21
    Jun 21st
    0 Files
  • 22
    Jun 22nd
    0 Files
  • 23
    Jun 23rd
    0 Files
  • 24
    Jun 24th
    0 Files
  • 25
    Jun 25th
    0 Files
  • 26
    Jun 26th
    0 Files
  • 27
    Jun 27th
    0 Files
  • 28
    Jun 28th
    0 Files
  • 29
    Jun 29th
    0 Files
  • 30
    Jun 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2018 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close