PT-2017-7036 · Wolfcms · Wolf Cms

Narendra Bhati + 1 · Publicado 2017-04-14 · Atualizado 2017-09-17 · CVE-2015-6568

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Wolf CMS versions prior to 0.8.3.1

Description The issue allows for unrestricted file rename and PHP code execution. This is because the file manager, located at the admin/plugin/file manager/browse/ endpoint, does not prevent a file extension from being changed to .php after initially uploading a JPEG image using the filename parameter. Exploitation of this issue requires a registered user with access to the upload functionality.

Recommendations For versions prior to 0.8.3.1, update to version 0.8.3.1 to resolve the issue. As a temporary workaround, consider restricting access to the file manager endpoint admin/plugin/file manager/browse/ to minimize the risk of exploitation. Additionally, restrict the use of the filename parameter in the upload functionality until the issue is resolved.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2015-6568

Produtos afetados

Wolf Cms

Referências · 9

• 🔥 http://websecgeeks.com/2015/08/wolf-cms-arbitrary-file-upload-to.html · Exploit
• 🔥 https://exploit-db.com/exploits/40004 · Exploit
• 🔥 https://exploit-db.com/exploits/38000 · Exploit
• https://github.com/wolfcms/wolfcms/releases/tag/0.8.3.1 · Nota
• https://github.com/wolfcms/wolfcms/commit/2160275b60736f706dfda132c7c46728c5b255fa · Correção
• https://github.com/wolfcms/wolfcms/issues/625 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6568 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-6568 · Nota de Segurança
• https://wolfcms.org/blog/2015/08/10/releasing-wolf-cms-0-8-3-1.html · Nota