Author

Calvin Phang

Risk

[

Security Risk High

]

0day-ID

0day-ID-34703

Category

web applications

Date add

19-07-2020

Platform

php

title: Multiple Vulnerabilities
            product: WonderCMS
 vulnerable version: <=3.1.0
      fixed version: -
         CVE number: -
             impact: High
           homepage: https://www.wondercms.com/
              found: 2020-04-30
                 by: Calvin Phang (Office Singapore)
                     SEC Consult Vulnerability Lab

                     An integrated part of SEC Consult
                     Europe | Asia | North America

                     https://www.sec-consult.com

=======================================================================


Vendor description:
-------------------
"WonderCMS is a free simple website builder. Aimed to be extremely easy
to install (1 step), light and simple to use.It's an open source flat
file CMS (Content Management System), built with PHP and developed
since 2008."

Source: https://www.wondercms.com/


Business recommendation:
------------------------
The vendor did not respond to our communication attempts, hence no patch is
available.

An in-depth security analysis performed by security professionals is highly
advised, as the software may be affected from further security issues.


Vulnerability overview/description:
-----------------------------------
1. Stored Cross Site Scripting via Filename (Authenticated user)
This vulnerability allows an authenticated user (admin) to upload files
with a malicious client side script as filename. It will be executed in
the browser of a user if he visits the manipulated URL.

2. Directory Traversal (Authenticated user)
This vulnerability allows an authenticated user (admin) to delete arbitrary
files via directory traversal on the operating system with the access rights
of the web server.

3. Upload of arbitrary files (Authenticated user)
It was identified that an authenticated user (admin) can bypass file type
checks and upload malicious files. In this specific case, arbitrary server
side PHP code such as web shells can be uploaded. As a result the attacker
can run arbitrary code on the server side with the privileges of the web
server. This could lead to a full system compromise.


Proof of concept:
-----------------
1. Stored Cross Site Scripting via Filename (Authenticated user)

[ PoC has been removed as no patch is available and the vendor is unresponsive ]

2. Directory Traversal (Authenticated user)

[ PoC has been removed as no patch is available and the vendor is unresponsive ]

3. Upload of arbitrary files (Authenticated user)

[ PoC has been removed as no patch is available and the vendor is unresponsive ]

Vulnerable / tested versions:
-----------------------------
WonderCMS version 3.0.7 has been tested, which was the latest version
available at the time of the test. Previous versions may also be affected.

On 18-05-2020, the vendor released a newer version 3.1.0. However, the latest
version are still vulnerable to the above vulnerabilities.


Vendor contact timeline:
------------------------
2020-05-06: Contacting vendor through report@wondercms.com; no response
2020-05-13: Follow-up with vendor; no response
2020-05-21: Follow-up with vendor; no response
2020-06-02: Follow-up with vendor; no response
2020-06-19: Follow-up with vendor; no response
2020-06-30: Tested the vulnerabilities in the latest version (3.1.0) that is
                        available on vendor's webpage, still affected.
2020-07-17: Public release of security advisory


Solution:
---------
The vendor did not respond to our communication attempts, hence no patch is
available.


Workaround:
-----------
None

#  0day.today [2024-11-15]  #