[webapps / 0day] - Digitalus 1.10.0 Alpha2 Arbitrary File Up
Posted on 01 December 2010
<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Strict//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd'><html xmlns='http://www.w3.org/1999/xhtml'><head><meta http-equiv='Content-Type' content='text/html; charset=utf-8' /><meta http-equiv='Content-Language' content='en' /><title>Digitalus 1.10.0 Alpha2 Arbitrary File Upload Vulnerability | Inj3ct0r - exploit database : vulnerability : 0day : shellcode</title><meta name='description' content='Digitalus 1.10.0 Alpha2 Arbitrary File Upload Vulnerability by eidelweiss in webapps / 0day | Inj3ct0r 1337 - exploit database : vulnerability : 0day : shellcode' /><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon' /><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss' /><script type='text/javascript'>var _gaq = _gaq || [];_gaq.push(["_setAccount", "UA-12725838-1"]);_gaq.push(["_setDomainName", "none"]);_gaq.push(["_setAllowLinker", true]);_gaq.push(["_trackPageview"]);(function(){var ga = document.createElement("script"); ga.type = "text/javascript"; ga.async = true;ga.src = ("https:" == document.location.protocol ? "https://ssl" : "http://www") + ".google-analytics.com/ga.js";var s = document.getElementsByTagName("script")[0]; s.parentNode.insertBefore(ga, s);})();</script></head><body><pre>=========================================================== Digitalus 1.10.0 Alpha2 Arbitrary File Upload Vulnerability =========================================================== [+]Script: Digitalus [+]Version: 1.10.0 Alpha2 [+]vendor: http://digitaluscms.com/ [+]Download: http://digitalus-cms.googlecode.com/files/digitalus_1.10.0_alpha2.zip ######################################################## [!]Author : eidelweiss [!]Contact: eidelweiss[at]windowslive[dot]com [!]Blog: http://eidelweiss-advisories.blogspot.com [!]Gratz : DealCyber member`s , yogyacarderlink crew , and YOU !!! [!]Dork: "Powered By Digitalus cms" Original Advisories: http://eidelweiss-advisories.blogspot.com/2010/12/digitalus-1100-alpha2-arbitrary-file.html -=[Advisories time]=- [-] 25 desember 2010 (gmt+7) vulnerability found [-] 25 desember 2010 (gmt+7) vulnerability analisys and testing [-] 26 desember 2010 (gmt+7) vulnerability report to vendor (first time report and no response) [-] 28 desember 2010 (gmt+7) vulnerability report to vendor (again still no response) [!] 01 desember 2010 22:00 (gmt+7) vulnerability publish ######################################################## -=[Description]=- Digitalus CMS is a new kind of CMS. The focus of this open source project is usable software as opposed to endless lists of features. We added a very flexible API to this base so you can customize virtually any aspect of the system. This creates a simple and elegant platform that you can use for a wide range of sites and requirements. ######################################################## -=[VUln Code]=- path/scripts/fckeditor/editor/filemanager/connectors/php/config.php [*] // SECURITY: You must explicitly enable this "connector". (Set it to "true"). [*] [*] $Config['Enabled'] = true ; [*] [*] // Path to user files relative to the document root. [*] $Config['UserFilesPath'] = '/media/' ; [*] [*] // Fill the following value it you prefer to specify the absolute path for the [*] // user files directory. Usefull if you are using a virtual directory, symbolic [*] // link or alias. Examples: 'C:\MySite\UserFiles\' or '/root/mysite/UserFiles/'. [*] // Attention: The above 'UserFilesPath' must point to the same directory. [*] [*] [*] $Config['AllowedExtensions']['File'] = array('7z', 'aiff', 'asf', 'avi', 'bmp', 'csv', 'doc', 'fla', 'flv', 'gif', 'gz', 'gzip', 'jpeg', 'jpg', 'mid', 'mov', 'mp3', 'mp4', 'mpc', 'mpeg', 'mpg', 'ods', 'odt', 'pdf', 'png', 'ppt', 'pxd', 'qt', 'ram', 'rar', 'rm', 'rmi', 'rmvb', 'rtf', 'sdc', 'sitd', 'swf', 'sxc', 'sxw', 'tar', 'tgz', 'tif', 'tiff', 'txt', 'vsd', 'wav', 'wma', 'wmv', 'xls', 'xml', 'zip') ; [*] $Config['DeniedExtensions']['File'] = array() ; [*] [*] $Config['AllowedExtensions']['Image'] = array('bmp','gif','jpeg','jpg','png') ; [*] $Config['DeniedExtensions']['Image'] = array() ; [*] [*] $Config['AllowedExtensions']['Flash'] = array('swf','flv') ; [*] $Config['DeniedExtensions']['Flash'] = array() ; [*] [*] $Config['AllowedExtensions']['Media'] = array('aiff', 'asf', 'avi', 'bmp', 'fla', 'flv', 'gif', 'jpeg', 'jpg', 'mid', 'mov', 'mp3', 'mp4', 'mpc', 'mpeg', 'mpg', 'png', 'qt', 'ram', 'rm', 'rmi', 'rmvb', 'swf', 'tif', 'tiff', 'wav', 'wma', 'wmv') ; [*] $Config['DeniedExtensions']['Media'] = array() ; with a default configuration of this script, an attacker might be able to upload arbitrary files containing malicious PHP code due to multiple file extensions isn't properly checked ######################################################## -=[ How To Exploit / P0C ]=- 1. attacker might be able to upload arbitrary files containing malicious PHP code due to multiple file extensions isn't properly checked using remode code execution. 2. Attacker also can exploit this vulnerability via browser by following this link http://127.0.0.1/scripts/fckeditor/editor/filemanager/connectors/test.html or http://127.0.0.1/scripts/fckeditor/editor/filemanager/connectors/uploadtest.html [*] your file while be here http://127.0.0.1/media/yourfile.extension <= here ######################################################## | -=[MERRY CHRISTMAS AND HAPPY NEW YEARS , Nothing impossible in this world even nobody`s perfect]=- | =========================| -=[ E0F ]=- |============================ # <a href='http://1337db.com/'>1337db.com</a> [2010-12-01]</pre></body></html>
