PT-2017-7036 · Wolfcms · Wolf Cms

Narendra Bhati + 1 · Published 2017-04-14 · Updated 2017-09-17 · CVE-2015-6568

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Wolf CMS versions prior to 0.8.3.1

Description The issue allows for unrestricted file rename and PHP code execution. This is because the file manager, located at the admin/plugin/file manager/browse/ endpoint, does not prevent a file extension from being changed to .php after initially uploading a JPEG image using the filename parameter. Exploitation of this issue requires a registered user with access to the upload functionality.

Recommendations For versions prior to 0.8.3.1, update to version 0.8.3.1 to resolve the issue. As a temporary workaround, consider restricting access to the file manager endpoint admin/plugin/file manager/browse/ to minimize the risk of exploitation. Additionally, restrict the use of the filename parameter in the upload functionality until the issue is resolved.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2015-6568

Affected Products

Wolf Cms

References · 9

• 🔥 http://websecgeeks.com/2015/08/wolf-cms-arbitrary-file-upload-to.html · Exploit
• 🔥 https://exploit-db.com/exploits/40004 · Exploit
• 🔥 https://exploit-db.com/exploits/38000 · Exploit
• https://github.com/wolfcms/wolfcms/commit/2160275b60736f706dfda132c7c46728c5b255fa · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2015-6568 · Security Note
• https://github.com/wolfcms/wolfcms/releases/tag/0.8.3.1 · Note
• https://github.com/wolfcms/wolfcms/issues/625 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6568 · Note
• https://wolfcms.org/blog/2015/08/10/releasing-wolf-cms-0-8-3-1.html · Note