Summary
CMSLogik is built on a solid & lightweight framework called CodeIgniter, and design powered by Bootstrap. This combination allows for greater security, extensive flexibility, and ease of use. You can use CMSLogik for almost any niche that your project might fall into.
Description
The vulnerability is caused due to the improper verification of uploaded files in '/application/controllers/support.php' script thru the 'upload_file_ajax()' function. This can be exploited to execute arbitrary PHP code by uploading a malicious PHP script file with multiple extensions in the '/support_files' directory. Normal user [level 113] authentication required.
/application/controllers/support.php:
-------------------------
143: public function upload_file_ajax()
144: {
145: $allowedExtensions = array('jpeg', 'jpg', 'gif', 'png', 'html', 'php', 'js', 'doc', 'docx', 'pdf', 'ppt', 'pps', 'pptx', 'ppsx');
146: $sizeLimit = 10 * 1024;
147: $params = array('extensions' => $allowedExtensions, 'size' => $sizeLimit);
148: $this->load->library('qqfileuploader', $params);
149:
150: $result = $this->qqfileuploader->handleUpload('./support_files');
151:
152: echo htmlspecialchars(json_encode($result), ENT_NOQUOTES);
153: }
Disclosure Timeline
05.04.2013Vulnerability discovered.
05.04.2013Contact with the vendor.
05.04.2013Vendor replies asking more details.
05.04.2013Sent detailed information to the vendor.
08.04.2013Vendor confirms the issues promising patch.
14.04.2013Vendor fixes the vulnerability.
14.04.2013Coordinated public security advisory released.