← Advisories

Pacer Edition CMS 2.1 (rm) Remote Arbitrary File Deletion Exploit

Medium
Advisory ID
ZSL-2011-5017
Release Date
09 June 2011
Vendor
The Pacer Edition - http://www.thepaceredition.com
Affected Version
RC 2.1 (SVN: 867)
CVE
N/A
Tested On
Microsoft Windows XP Professional SP3 (EN), Apache 2.2.14 (Win32), PHP 5.3.1, MySQL 5.1.41
Summary

The 'Pacer Edition' is a Content Management System(CMS) written using PHP 5.2.9 as a minimum requirement. The Pacer Edition CMS was based from Website baker core and has been completely redesigned with a whole new look and feel along with many new advanced features to allow you to build sites exactly how you want and make them, 100% yours!

Description

Input passed to the 'rm' parameter in modules/code/syntax_check.php is not properly sanitised before being used to delete files. This can be exploited to delete files with the permissions of the web server via directory traversal sequences passed within the 'rm' parameter.

/modules/code/syntax_check.php ---------------- 99: if (isset($_REQUEST['rm'])) { 100: @unlink($_REQUEST['rm']); 101: die(); 102: }
Proof of Concept
Disclosure Timeline
N/A
Credits
Vulnerability discovered by Gjoko Krstic
References
Changelog
09.06.2011Initial release
10.06.2011Added reference [2] and [3]
11.06.2011Added reference [4] and [5]
12.06.2011Added reference [6]