PT-2017-7035 · Wolfcms · Wolf Cms

S0Nk3Y · Published 2017-04-14 · Updated 2017-09-17 · CVE-2015-6567

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Wolf CMS versions prior to 0.8.3.1

Description The issue allows for unrestricted file upload and PHP code execution due to improper validation of the filename parameter in the file manager, accessible at the "admin/plugin/file manager/browse/" endpoint. This can be exploited by a registered user with upload access.

Recommendations For versions prior to 0.8.3.1, update to version 0.8.3.1 to resolve the issue. As a temporary workaround, consider restricting access to the file manager or disabling the upload functionality until the update can be applied.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2015-6567

Affected Products

Wolf Cms

References · 9

• 🔥 http://websecgeeks.com/2015/08/wolf-cms-arbitrary-file-upload-to.html · Exploit
• 🔥 https://exploit-db.com/exploits/40004 · Exploit
• 🔥 https://exploit-db.com/exploits/38000 · Exploit
• https://github.com/wolfcms/wolfcms/commit/2160275b60736f706dfda132c7c46728c5b255fa · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2015-6567 · Security Note
• https://github.com/wolfcms/wolfcms/releases/tag/0.8.3.1 · Note
• https://github.com/wolfcms/wolfcms/issues/625 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6567 · Note
• https://wolfcms.org/blog/2015/08/10/releasing-wolf-cms-0-8-3-1.html · Note