← Advisories

Kemana Directory 1.5.6 (run param) Local File Inclusion Vulnerability

Medium
Advisory ID
ZSL-2014-5177
Release Date
25 March 2014
Vendor
Affected Version
1.5.6
CVE
N/A
Tested On
Apache/2.4.7 (Win32), PHP/5.5.6, MySQL 5.6.14
Summary

Experience the ultimate directory script solution with Kemana. Create your own Yahoo or Dmoz easily with Kemana. Unique Kemana's features including: CMS engine based on our qEngine, multiple directories support, user friendly administration control panel, easy to use custom fields, unsurpassed flexibility.

Description

Kemana suffers from an authenticated file inclusion vulnerability (LFI) when input passed thru the 'run' parameter to task.php is not properly verified before being used to include files. This can be exploited to include files from local resources with directory traversal attacks.

Proof of Concept
Disclosure Timeline
07.03.2014Vulnerability discovered.
10.03.2014Vendor contacted.
11.03.2014Vendor responds asking more details.
11.03.2014Sent details to the vendor.
12.03.2014Working with the vendor.
13.03.2014Vendor working on a new version.
21.03.2014Asked vendor for status update.
21.03.2014Vendor promises patch release in April.
25.03.2014Public security advisory released.
Credits
Vulnerability discovered by Gjoko Krstic
References
Changelog
25.03.2014Initial release
26.03.2014Added reference [3], [4] and [5]
27.03.2014Added reference [6]
31.03.2014Added reference [7]
09.04.2014Added reference [8]