exploit the possibilities

WonderCMS 3.1.0 XSS / Directory Traversal / File Upload

WonderCMS 3.1.0 XSS / Directory Traversal / File Upload
Posted Jul 17, 2020
Authored by Calvin Phang | Site sec-consult.com

WonderCMS versions 3.1.0 and below suffer from directory traversal, persistent cross site scripting, and file upload vulnerabilities.

tags | advisory, vulnerability, xss, file upload
MD5 | c87a3407d183c31bf41f5245e885cf76

WonderCMS 3.1.0 XSS / Directory Traversal / File Upload

Change Mirror Download
SEC Consult Vulnerability Lab Security Advisory < 20200717-0 >
=======================================================================
title: Multiple Vulnerabilities
product: WonderCMS
vulnerable version: <=3.1.0
fixed version: -
CVE number: -
impact: High
homepage: https://www.wondercms.com/
found: 2020-04-30
by: Calvin Phang (Office Singapore)
SEC Consult Vulnerability Lab

An integrated part of SEC Consult
Europe | Asia | North America

https://www.sec-consult.com

=======================================================================


Vendor description:
-------------------
"WonderCMS is a free simple website builder. Aimed to be extremely easy
to install (1 step), light and simple to use.It's an open source flat
file CMS (Content Management System), built with PHP and developed
since 2008."

Source: https://www.wondercms.com/


Business recommendation:
------------------------
The vendor did not respond to our communication attempts, hence no patch is
available.

An in-depth security analysis performed by security professionals is highly
advised, as the software may be affected from further security issues.


Vulnerability overview/description:
-----------------------------------
1. Stored Cross Site Scripting via Filename (Authenticated user)
This vulnerability allows an authenticated user (admin) to upload files
with a malicious client side script as filename. It will be executed in
the browser of a user if he visits the manipulated URL.

2. Directory Traversal (Authenticated user)
This vulnerability allows an authenticated user (admin) to delete arbitrary
files via directory traversal on the operating system with the access rights
of the web server.

3. Upload of arbitrary files (Authenticated user)
It was identified that an authenticated user (admin) can bypass file type
checks and upload malicious files. In this specific case, arbitrary server
side PHP code such as web shells can be uploaded. As a result the attacker
can run arbitrary code on the server side with the privileges of the web
server. This could lead to a full system compromise.


Proof of concept:
-----------------
1. Stored Cross Site Scripting via Filename (Authenticated user)

[ PoC has been removed as no patch is available and the vendor is unresponsive ]

2. Directory Traversal (Authenticated user)

[ PoC has been removed as no patch is available and the vendor is unresponsive ]

3. Upload of arbitrary files (Authenticated user)

[ PoC has been removed as no patch is available and the vendor is unresponsive ]

Vulnerable / tested versions:
-----------------------------
WonderCMS version 3.0.7 has been tested, which was the latest version
available at the time of the test. Previous versions may also be affected.

On 18-05-2020, the vendor released a newer version 3.1.0. However, the latest
version are still vulnerable to the above vulnerabilities.


Vendor contact timeline:
------------------------
2020-05-06: Contacting vendor through report@wondercms.com; no response
2020-05-13: Follow-up with vendor; no response
2020-05-21: Follow-up with vendor; no response
2020-06-02: Follow-up with vendor; no response
2020-06-19: Follow-up with vendor; no response
2020-06-30: Tested the vulnerabilities in the latest version (3.1.0) that is
available on vendor's webpage, still affected.
2020-07-17: Public release of security advisory


Solution:
---------
The vendor did not respond to our communication attempts, hence no patch is
available.


Workaround:
-----------
None


Advisory URL:
-------------
https://www.sec-consult.com/en/vulnerability-lab/advisories/index.html


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

SEC Consult Vulnerability Lab

SEC Consult
Europe | Asia | North America

About SEC Consult Vulnerability Lab
The SEC Consult Vulnerability Lab is an integrated part of SEC Consult. It
ensures the continued knowledge gain of SEC Consult in the field of network
and application security to stay ahead of the attacker. The SEC Consult
Vulnerability Lab supports high-quality penetration testing and the evaluation
of new offensive and defensive technologies for our customers. Hence our
customers obtain the most current information about vulnerabilities and valid
recommendation about the risk profile of new technologies.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Interested to work with the experts of SEC Consult?
Send us your application https://www.sec-consult.com/en/career/index.html

Interested in improving your cyber security with the experts of SEC Consult?
Contact our local offices https://www.sec-consult.com/en/contact/index.html
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Mail: research at sec-consult dot com
Web: https://www.sec-consult.com
Blog: http://blog.sec-consult.com
Twitter: https://twitter.com/sec_consult

EOF C. Phang / @2020


Login or Register to add favorites

File Archive:

January 2021

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jan 1st
    4 Files
  • 2
    Jan 2nd
    3 Files
  • 3
    Jan 3rd
    3 Files
  • 4
    Jan 4th
    33 Files
  • 5
    Jan 5th
    31 Files
  • 6
    Jan 6th
    21 Files
  • 7
    Jan 7th
    15 Files
  • 8
    Jan 8th
    19 Files
  • 9
    Jan 9th
    1 Files
  • 10
    Jan 10th
    1 Files
  • 11
    Jan 11th
    33 Files
  • 12
    Jan 12th
    19 Files
  • 13
    Jan 13th
    27 Files
  • 14
    Jan 14th
    8 Files
  • 15
    Jan 15th
    16 Files
  • 16
    Jan 16th
    0 Files
  • 17
    Jan 17th
    0 Files
  • 18
    Jan 18th
    0 Files
  • 19
    Jan 19th
    0 Files
  • 20
    Jan 20th
    0 Files
  • 21
    Jan 21st
    0 Files
  • 22
    Jan 22nd
    0 Files
  • 23
    Jan 23rd
    0 Files
  • 24
    Jan 24th
    0 Files
  • 25
    Jan 25th
    0 Files
  • 26
    Jan 26th
    0 Files
  • 27
    Jan 27th
    0 Files
  • 28
    Jan 28th
    0 Files
  • 29
    Jan 29th
    0 Files
  • 30
    Jan 30th
    0 Files
  • 31
    Jan 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close