0day.today - Biggest Exploit Database in the World.
Things you should know about 0day.today:
Administration of this site uses the official contacts. Beware of impostors!
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!
Please, beware of scammers!
Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Digitalus 1.10.0 Alpha2 Arbitrary File Upload Vulnerability
=========================================================== Digitalus 1.10.0 Alpha2 Arbitrary File Upload Vulnerability =========================================================== [+]Script: Digitalus [+]Version: 1.10.0 Alpha2 [+]vendor: http://digitaluscms.com/ [+]Download: http://digitalus-cms.googlecode.com/files/digitalus_1.10.0_alpha2.zip ######################################################## [!]Author : eidelweiss [!]Contact: eidelweiss[at]windowslive[dot]com [!]Blog: http://eidelweiss-advisories.blogspot.com [!]Gratz : DealCyber member`s , yogyacarderlink crew , and YOU !!! [!]Dork: "Powered By Digitalus cms" Original Advisories: http://eidelweiss-advisories.blogspot.com/2010/12/digitalus-1100-alpha2-arbitrary-file.html -=[Advisories time]=- [-] 25 desember 2010 (gmt+7) vulnerability found [-] 25 desember 2010 (gmt+7) vulnerability analisys and testing [-] 26 desember 2010 (gmt+7) vulnerability report to vendor (first time report and no response) [-] 28 desember 2010 (gmt+7) vulnerability report to vendor (again still no response) [!] 01 desember 2010 22:00 (gmt+7) vulnerability publish ######################################################## -=[Description]=- Digitalus CMS is a new kind of CMS. The focus of this open source project is usable software as opposed to endless lists of features. We added a very flexible API to this base so you can customize virtually any aspect of the system. This creates a simple and elegant platform that you can use for a wide range of sites and requirements. ######################################################## -=[VUln Code]=- path/scripts/fckeditor/editor/filemanager/connectors/php/config.php [*] // SECURITY: You must explicitly enable this "connector". (Set it to "true"). [*] [*] $Config['Enabled'] = true ; [*] [*] // Path to user files relative to the document root. [*] $Config['UserFilesPath'] = '/media/' ; [*] [*] // Fill the following value it you prefer to specify the absolute path for the [*] // user files directory. Usefull if you are using a virtual directory, symbolic [*] // link or alias. Examples: 'C:\\MySite\\UserFiles\\' or '/root/mysite/UserFiles/'. [*] // Attention: The above 'UserFilesPath' must point to the same directory. [*] [*] [*] $Config['AllowedExtensions']['File'] = array('7z', 'aiff', 'asf', 'avi', 'bmp', 'csv', 'doc', 'fla', 'flv', 'gif', 'gz', 'gzip', 'jpeg', 'jpg', 'mid', 'mov', 'mp3', 'mp4', 'mpc', 'mpeg', 'mpg', 'ods', 'odt', 'pdf', 'png', 'ppt', 'pxd', 'qt', 'ram', 'rar', 'rm', 'rmi', 'rmvb', 'rtf', 'sdc', 'sitd', 'swf', 'sxc', 'sxw', 'tar', 'tgz', 'tif', 'tiff', 'txt', 'vsd', 'wav', 'wma', 'wmv', 'xls', 'xml', 'zip') ; [*] $Config['DeniedExtensions']['File'] = array() ; [*] [*] $Config['AllowedExtensions']['Image'] = array('bmp','gif','jpeg','jpg','png') ; [*] $Config['DeniedExtensions']['Image'] = array() ; [*] [*] $Config['AllowedExtensions']['Flash'] = array('swf','flv') ; [*] $Config['DeniedExtensions']['Flash'] = array() ; [*] [*] $Config['AllowedExtensions']['Media'] = array('aiff', 'asf', 'avi', 'bmp', 'fla', 'flv', 'gif', 'jpeg', 'jpg', 'mid', 'mov', 'mp3', 'mp4', 'mpc', 'mpeg', 'mpg', 'png', 'qt', 'ram', 'rm', 'rmi', 'rmvb', 'swf', 'tif', 'tiff', 'wav', 'wma', 'wmv') ; [*] $Config['DeniedExtensions']['Media'] = array() ; with a default configuration of this script, an attacker might be able to upload arbitrary files containing malicious PHP code due to multiple file extensions isn't properly checked ######################################################## -=[ How To Exploit / P0C ]=- 1. attacker might be able to upload arbitrary files containing malicious PHP code due to multiple file extensions isn't properly checked using remode code execution. 2. Attacker also can exploit this vulnerability via browser by following this link http://127.0.0.1/scripts/fckeditor/editor/filemanager/connectors/test.html or http://127.0.0.1/scripts/fckeditor/editor/filemanager/connectors/uploadtest.html [*] your file while be here http://127.0.0.1/media/yourfile.extension <= here ######################################################## | -=[MERRY CHRISTMAS AND HAPPY NEW YEARS , Nothing impossible in this world even nobody`s perfect]=- | =========================| -=[ E0F ]=- |============================ # 0day.today [2024-09-29] #