exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

724CMS 5.01 / 4.59 / 4.01 / 3.01 Directory Traversal

724CMS 5.01 / 4.59 / 4.01 / 3.01 Directory Traversal
Posted Mar 16, 2015
Authored by Wang Jing

724CMS versions 5.01, 4.59, 4.01, and 3.01 suffer from directory traversal vulnerabilities.

tags | exploit, vulnerability, file inclusion
SHA-256 | 3d0fafa6b355dddb83a9aedfad6f5a78c568e14a2a8986ac2f669596c4c8292f

724CMS 5.01 / 4.59 / 4.01 / 3.01 Directory Traversal

Change Mirror Download
*724CMS 5.01 Directory (Path) Traversal Security Vulnerabilities*


Exploit Title: 724CMS /section.php Module Parameter Directory Traversal
Security Vulnerabilities
Vendor: 724CMS
Product: 724CMS
Vulnerable Versions: 3.01 4.01 4.59 5.01
Tested Version: 5.01
Advisory Publication: March 14, 2015
Latest Update: March 14, 2015
Vulnerability Type: Improper Limitation of a Pathname to a Restricted
Directory ('Path Traversal') [CWE-22]
CVE Reference: *
Impact CVSS Severity (version 2.0):
CVSS v2 Base Score: 7.5 (HIGH) (AV:N/AC:L/Au:N/C:P/I:P/A:P) (legend)
Impact Subscore: 6.4
Exploitability Subscore: 10.0
Discover and Author: Wang Jing [CCRG, Nanyang Technological University
(NTU), Singapore]







*Recommendation Details:*


*(1) Vendor & Product Description:*


*Vendor:*
724CMS Enterprise



*Product & Vulnerable Versions:*
724CMS
3.01
4.01
4.59
5.01





*Vendor URL & download:*
724CMS can be bargained from here,
http://724cms.com/



*Product Introduction Overview:*
"724CMS is a content management system (CMS) that has customers spread in
Canada, Japan, Korean, the United States, European and many others. It
allows publishing, editing and modifying content, organizing, deleting as
well as maintenance from a central interface. Meanwhile, 724CMS provides
procedures to manage workflow in a collaborative environment."

"A CMS helps you create and store content in a shared repository. It then
manages the relationships between content items for you (e.g. keeping track
of where they fit into the site hierarchy). Finally, it ensures that each
content item is connected to the right style sheet when it comes to be
published. Some CMSs also provide facilities to track the status of content
items through editorial processes and workflows."






*(2) Vulnerability Details:*
724CMS web application has a security bug problem. It can be exploited by
Directory Traversal - Local File Include (LFI) attacks. A local file
inclusion (LFI) flaw is due to the script not properly sanitizing user
input, specifically path traversal style attacks (e.g. '../../') supplied
to the parameters. With a specially crafted request, a remote attacker can
include arbitrary files from the targeted host or from a remote host . This
may allow disclosing file contents or executing files like PHP scripts.
Such attacks are limited due to the script only calling files already on
the target host.

Several 724CMS products vulnerabilities have been found by some other bug
hunter researchers before. 724CMS has patched some of them. The MITRE
Corporation is a not-for-profit company that operates multiple federally
funded research and development centers (FFRDCs), which provide innovative,
practical solutions for some of our nation's most critical challenges in
defense and intelligence, aviation, civil systems, homeland security, the
judiciary, healthcare, and cybersecurity. It has published suggestions,
advisories, solutions details related to 724CMS vulnerabilities.


*(2.1) *The first cipher programming flaw occurs at "/section.php" page
with "&Module" parameter.









*References:*
http://www.tetraph.com/security/directory-traversal-vulnerability/724cms-5-01-directory-path-traversal-security-vulnerabilities/
http://securityrelated.blogspot.com/2015/03/724cms-501-directory-path-traversal.html
http://www.inzeed.com/kaleidoscope/computer-web-security/724cms-5-01-directory-path-traversal-security-vulnerabilities/
http://diebiyi.com/articles/%E5%AE%89%E5%85%A8/724cms-5-01-directory-path-traversal-security-vulnerabilities/
https://computertechhut.wordpress.com/2015/03/14/724cms-5-01-directory-path-traversal-security-vulnerabilities/
http://marc.info/?a=139222176300014&r=1&w=4
http://en.hackdig.com/wap/?id=17404







--
Wang Jing,
Division of Mathematical Sciences (MAS),
School of Physical and Mathematical Sciences (SPMS),
Nanyang Technological University (NTU),
Singapore.
http://www.tetraph.com/wangjing/
https://twitter.com/justqdjing


Login or Register to add favorites

File Archive:

November 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Nov 1st
    30 Files
  • 2
    Nov 2nd
    0 Files
  • 3
    Nov 3rd
    0 Files
  • 4
    Nov 4th
    12 Files
  • 5
    Nov 5th
    44 Files
  • 6
    Nov 6th
    18 Files
  • 7
    Nov 7th
    9 Files
  • 8
    Nov 8th
    8 Files
  • 9
    Nov 9th
    3 Files
  • 10
    Nov 10th
    0 Files
  • 11
    Nov 11th
    0 Files
  • 12
    Nov 12th
    0 Files
  • 13
    Nov 13th
    0 Files
  • 14
    Nov 14th
    0 Files
  • 15
    Nov 15th
    0 Files
  • 16
    Nov 16th
    0 Files
  • 17
    Nov 17th
    0 Files
  • 18
    Nov 18th
    0 Files
  • 19
    Nov 19th
    0 Files
  • 20
    Nov 20th
    0 Files
  • 21
    Nov 21st
    0 Files
  • 22
    Nov 22nd
    0 Files
  • 23
    Nov 23rd
    0 Files
  • 24
    Nov 24th
    0 Files
  • 25
    Nov 25th
    0 Files
  • 26
    Nov 26th
    0 Files
  • 27
    Nov 27th
    0 Files
  • 28
    Nov 28th
    0 Files
  • 29
    Nov 29th
    0 Files
  • 30
    Nov 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2024 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close