Open GodEpic opened 5 years ago
Hello. I have maid some changes to project structure. I have added check for realpath. I have tested your examples now, probably all fixed, please check. I'm only start this fork, so I would fix next issues, when I have free time. https://github.com/cryptoprof/wcms/tree/feature/securityFix
A Arbitrary File Reading Vulnerability in wex/cssjs.php There is a vulnerability that can read and modify any files to getshell. Affected software:WCMS V0.3.2
poc: use ../ to directory traversal vulnerability. I can read config.php get admin account. /wex/cssjs.php?path=..//wcms/config.php&type=css![image](https://user-images.githubusercontent.com/32690714/61185650-54d01280-a68e-11e9-8833-0b43f801e2f7.png)
I can still do it.
![image](https://user-images.githubusercontent.com/32690714/61185533-2ef63e00-a68d-11e9-9be3-7036634e216c.png)
Now let's modify this file.
so I can modify php file to getshell. That Access without login.
![image](https://user-images.githubusercontent.com/32690714/61185734-4a624880-a68f-11e9-8590-1ef2cf3d178c.png)
Source code: wex/cssjs.php
We can see there are not filtering with '../' , that’s why make directory traversal vulnerability.