Cubic CMS Multiple Security Vulnerabilities
BID:64660
Info
Cubic CMS Multiple Security Vulnerabilities
| Bugtraq ID: | 64660 |
| Class: | Input Validation Error |
| CVE: |
CVE-2014-1619 |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 03 2014 12:00AM |
| Updated: | Mar 19 2015 09:08AM |
| Credit: | Eugenio Delfa |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
Cubic CMS Multiple Security Vulnerabilities
Cubic CMS is prone to multiple security vulnerabilities because it fails to sufficiently sanitize user-supplied input.
An attacker can exploit these issues to compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, retrieve local data, execute arbitrary code within the context of the affected application, obtain sensitive information that can aid in launching further attacks.
Cubic CMS is prone to multiple security vulnerabilities because it fails to sufficiently sanitize user-supplied input.
An attacker can exploit these issues to compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, retrieve local data, execute arbitrary code within the context of the affected application, obtain sensitive information that can aid in launching further attacks.
Exploit / POC
Cubic CMS Multiple Security Vulnerabilities
Attackers can exploit these issues using browser.
Following example URLs are available.
For SQL Injection:
http://www.example.com/recursos/agent.php?resource_id=[SQL Injection]
http://www.example.com/recursos/agent.php?version_id=[SQL Injection]
For LFI:
http://www.example.com/recursos/agent.php?path=[LFI]
For Full Path Disclosure:
http://www.example.com/id/-22
http://www.example.com/foo.bar
Attackers can exploit these issues using browser.
Following example URLs are available.
For SQL Injection:
http://www.example.com/recursos/agent.php?resource_id=[SQL Injection]
http://www.example.com/recursos/agent.php?version_id=[SQL Injection]
For LFI:
http://www.example.com/recursos/agent.php?path=[LFI]
For Full Path Disclosure:
http://www.example.com/id/-22
http://www.example.com/foo.bar
Solution / Fix
Cubic CMS Multiple Security Vulnerabilities
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.