Assault Content Manager v.1.2 Directory Traverlal Vulnerability

SEVERITY:

Medium

SOFTWARE:

Assault Content Manager v1.2

http://www.assaultcms.com/

INFO:

Assault Content Manager v1.2 is a simple CMS that uses files to store information

DESCRIPTION:

Assault Content Manager v1.2 is vulnerable to a directory traversal attack

Examples:

Create an account and login.From then do this request:

http://127.0.0.1/acm/index.php?downloads&dir=../

The vulnerable code is:

$link="?downloads&dir={$value}

Where $value has no protection

*The bug isn't аffected by magic_quotes_gpc or register_globals

VENDOR STATUS

Vendor was contacted but no response received till date.

MY FIX:

Open downloads.php(it's located in the includes folder) and after $direct=$_SERVER['QUERY_STRING']; put:

if(preg_match("/\.\./i", $dir)){echo "HACKING attempt !";exit(0);} //keep it simple and effective !

This vulnerability was discovered by matrix_killer

mail : matrix_k at abv.bg

Greets: EcLiPsE, Blood3R and Acid_BDS

---

http://ide.li/ - портал за българите по света. Статии, новини, форуми, снимки, информация.