Author

Tim Coen

Risk

[

Security Risk Critical

]

0day-ID

0day-ID-24694

Category

web applications

Date add

10-12-2015

Platform

php

redaxscript 2.5.0 - Multiple Vulnerabilities

Description

The module file_manager allows for file uploads, and uses exif_imagetype to
check the validity of the file.

By setting the first bytes of the uploaded file to that of a valid image type,
an attacker can easily bypass this check and thus upload files of dangerous
type.

It should be noted that only files with the name index.php will be executed, as
access to all other PHP files is forbidden by a htaccess file.

An account that has access to the module "File manager" is needed to exploit
this issue.

 Code


/modules/file_manager/index.php
function file_manager_upload($directory = '')
{
        $file = $_FILES['file']['tmp_name'];
        $file_name = file_manager_clean_file_name($_FILES['file']['name']);
        $file_size = $_FILES['file']['size'];

        /* validate post */

        if (function_exists('exif_imagetype'))
        {
                if (exif_imagetype($file) == '')
                {
                        $error = l('file_type_limit', '_file_manager') . l('point');
                }
        }

 Solution

To mitigate this issue please remove the file_manager module.



---------------------------------------

redaxscript 2.5.0 Cross Site Scripting


Description

There is a persistent XSS vulnerability when leaving comments. It requires the
admin to hover over a link to trigger the injected code.

This issue can lead to the injection of JavaScript keyloggers, or the bypassing
of CSRF protection. In this case, this may lead to code execution.

The issue has been partially fixed in version 2.6.0. However, it was still
possible to inject a style attribute, making XSS in older browsers possible.
This has been fixed in version 2.6.1.

 Proof of Concept


1. Create a comment, as comment text use:
    comment" onmouseover=alert(1) foo="
2. In the sidebar, hover over the comment to trigger the XSS.

 Solution

To mitigate this issue please upgrade at least to version 2.6.1:

http://redaxscript.com/files/releases/redaxscript_2.6.1_full.zip

Please note that a newer version might already be available.

#  0day.today [2024-11-15]  #