----------------------------------------------------------------------


Proof-of-Concept (PoC) and Extended Analysis available for customers.

Get a free trial, contact sales@secunia.com


----------------------------------------------------------------------

TITLE:
Webessence CMS Security Issue and Vulnerability

SECUNIA ADVISORY ID:
SA39550

VERIFY ADVISORY:
http://secunia.com/advisories/39550/

DESCRIPTION:
A security issue and a vulnerability have been discovered in
Webessence CMS, which can be exploited by malicious users to
compromise a vulnerable system and by malicious people to conduct SQL
injection attacks.

1) The security issue is caused due to the
webessence/admin/media_new_do.php script allowing the upload of files
with certain extensions to a folder inside the webroot. This can be
exploited to execute arbitrary PHP code by uploading a PHP file with
e.g. an appended ".phtml" extension.

Successful exploitation requires "Manage media" permission and that
Apache is not configured to handle the mime-type for uploadable media
files.

2) Input passed via the "itemid" parameter to
webessence/comment_do.php (when "name" and "comment" are set to any
value) is not properly sanitised before being used in a SQL query.
This can be exploited to manipulate SQL queries by injecting
arbitrary SQL code.

The security issue and the vulnerability are confirmed in version
1.0.3. Other versions may also be affected.

SOLUTION:
Restrict access to the "webessence/uploads" directory (e.g. via
.htaccess). Edit the source code to ensure that input is properly
sanitised.

PROVIDED AND/OR DISCOVERED BY:
white_sheep, R00T_ATI, and epicfail

ORIGINAL ADVISORY:
http://www.exploit-db.com/exploits/12387

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
private users keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------