Lanius CMS 'upload.php' Arbitrary File Upload Vulnerability
BID:34415
Info
Lanius CMS 'upload.php' Arbitrary File Upload Vulnerability
| Bugtraq ID: | 34415 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 07 2009 12:00AM |
| Updated: | Apr 08 2009 10:16PM |
| Credit: | EgiX |
| Vulnerable: |
Lanius CMS Lanius CMS 0.5.2 Drake CMS Drake CMS 0.4.11 Drake CMS Drake CMS 0.4.9 Drake CMS Drake CMS 0.4.6 Drake CMS Drake CMS 0.4.11 RC8 Drake CMS Drake CMS 0.4.10 RC6 |
| Not Vulnerable: |
Lanius CMS Lanius CMS 0.5.2 r1094 |
Discussion
Lanius CMS 'upload.php' Arbitrary File Upload Vulnerability
Lanius CMS (formerly known as Drake CMS) is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input.
An attacker can exploit this vulnerability to upload arbitrary code and execute it in the context of the webserver process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible.
Versions prior to Lanius CMS 0.5.2 r1094 are vulnerable. Note that Drake CMS 0.4.6 and later versions are also vulnerable.
Lanius CMS (formerly known as Drake CMS) is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input.
An attacker can exploit this vulnerability to upload arbitrary code and execute it in the context of the webserver process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible.
Versions prior to Lanius CMS 0.5.2 r1094 are vulnerable. Note that Drake CMS 0.4.6 and later versions are also vulnerable.
Exploit / POC
Lanius CMS 'upload.php' Arbitrary File Upload Vulnerability
Attackers can exploit this issue via a browser.
The following exploit code is available:
Attackers can exploit this issue via a browser.
The following exploit code is available:
Solution / Fix
Lanius CMS 'upload.php' Arbitrary File Upload Vulnerability
Solution:
The vendor has released an update. Please see the references for more information.
Lanius CMS Lanius CMS 0.5.2
Solution:
The vendor has released an update. Please see the references for more information.
Lanius CMS Lanius CMS 0.5.2
-
Lanius CMS revision_patch_from_v0.5.2_r1050_to_v0.5.2_r1094.zip
http://downloads.sourceforge.net/laniuscms/revision_patch_from_v0.5.2_ r1050_to_v0.5.2_r1094.zip
References
Lanius CMS 'upload.php' Arbitrary File Upload Vulnerability
References:
References:
- Lanius CMS Homepage (Lanius CMS)