TinyCMS Local File Include and Arbitrary File Upload Vulnerabilities

Bugtraq ID:	53761
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 03 2012 12:00AM
Updated:	Jun 03 2012 12:00AM
Credit:	KedAns-Dz
Vulnerable:	TinyCMS TinyCMS 1.3
Not Vulnerable:

TinyCMS Local File Include and Arbitrary File Upload Vulnerabilities

TinyCMS is prone to multiple local file-include vulnerabilities and an arbitrary-file-upload vulnerability.

An attacker can exploit these issues to upload arbitrary files onto the web server, execute arbitrary local files within the context of the web server, and obtain sensitive information.

TinyCMS 1.3 is vulnerable; other versions may also be affected.

TinyCMS Local File Include and Arbitrary File Upload Vulnerabilities

An attacker can exploit these issues through a browser.

The following example inputs are available:

• /data/vulnerabilities/exploits/53761.txt
• /data/vulnerabilities/exploits/53761.php.txt

TinyCMS Local File Include and Arbitrary File Upload Vulnerabilities

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

TinyCMS Local File Include and Arbitrary File Upload Vulnerabilities

References:

• TinyCMS Homepage (TinyCMS)