← Advisories

CMSLogik 1.2.1 (upload_file_ajax()) Shell Upload Exploit

High
Advisory ID
ZSL-2013-5138
Release Date
14 April 2013
Affected Version
1.2.1 and 1.2.0
CVE
N/A
Tested On
Router Webserver
Summary

CMSLogik is built on a solid & lightweight framework called CodeIgniter, and design powered by Bootstrap. This combination allows for greater security, extensive flexibility, and ease of use. You can use CMSLogik for almost any niche that your project might fall into.

Description

The vulnerability is caused due to the improper verification of uploaded files in '/application/controllers/support.php' script thru the 'upload_file_ajax()' function. This can be exploited to execute arbitrary PHP code by uploading a malicious PHP script file with multiple extensions in the '/support_files' directory. Normal user [level 113] authentication required.

/application/controllers/support.php: ------------------------- 143: public function upload_file_ajax() 144: { 145: $allowedExtensions = array('jpeg', 'jpg', 'gif', 'png', 'html', 'php', 'js', 'doc', 'docx', 'pdf', 'ppt', 'pps', 'pptx', 'ppsx'); 146: $sizeLimit = 10 * 1024; 147: $params = array('extensions' => $allowedExtensions, 'size' => $sizeLimit); 148: $this->load->library('qqfileuploader', $params); 149: 150: $result = $this->qqfileuploader->handleUpload('./support_files'); 151: 152: echo htmlspecialchars(json_encode($result), ENT_NOQUOTES); 153: }
Proof of Concept
Disclosure Timeline
05.04.2013Vulnerability discovered.
05.04.2013Contact with the vendor.
05.04.2013Vendor replies asking more details.
05.04.2013Sent detailed information to the vendor.
08.04.2013Vendor confirms the issues promising patch.
14.04.2013Vendor fixes the vulnerability.
14.04.2013Coordinated public security advisory released.
Credits
Vulnerability discovered by Gjoko Krstic
References
Changelog
14.04.2013Initial release
15.04.2013Added reference [1] and [2]
16.04.2013Added reference [3] and [4]