=======================================================================
title: Multiple Vulnerabilities
product: WonderCMS
vulnerable version: <=3.1.0
fixed version: -
CVE number: -
impact: High
homepage: https://www.wondercms.com/
found: 2020-04-30
by: Calvin Phang (Office Singapore)
SEC Consult Vulnerability Lab
An integrated part of SEC Consult
Europe | Asia | North America
https://www.sec-consult.com
=======================================================================
Vendor description:
-------------------
"WonderCMS is a free simple website builder. Aimed to be extremely
easy
to install (1 step), light and simple to use.It's an open source
flat
file CMS (Content Management System), built with PHP and
developed
since 2008."
Source: https://www.wondercms.com/
Business recommendation:
------------------------
The vendor did not respond to our communication attempts, hence no
patch is
available.
An in-depth security analysis performed by security
professionals is highly
advised, as the software may be affected from further security
issues.
Vulnerability overview/description:
-----------------------------------
1. Stored Cross Site Scripting via Filename (Authenticated
user)
This vulnerability allows an authenticated user (admin) to upload
files
with a malicious client side script as filename. It will be
executed in
the browser of a user if he visits the manipulated URL.
2. Directory Traversal (Authenticated user)
This vulnerability allows an authenticated user (admin) to delete
arbitrary
files via directory traversal on the operating system with the
access rights
of the web server.
3. Upload of arbitrary files (Authenticated user)
It was identified that an authenticated user (admin) can bypass
file type
checks and upload malicious files. In this specific case, arbitrary
server
side PHP code such as web shells can be uploaded. As a result the
attacker
can run arbitrary code on the server side with the privileges of
the web
server. This could lead to a full system compromise.
Proof of concept:
-----------------
1. Stored Cross Site Scripting via Filename (Authenticated
user)
[ PoC has been removed as no patch is available and the vendor is unresponsive ]
2. Directory Traversal (Authenticated user)
[ PoC has been removed as no patch is available and the vendor is unresponsive ]
3. Upload of arbitrary files (Authenticated user)
[ PoC has been removed as no patch is available and the vendor is unresponsive ]
Vulnerable / tested versions:
-----------------------------
WonderCMS version 3.0.7 has been tested, which was the latest
version
available at the time of the test. Previous versions may also be
affected.
On 18-05-2020, the vendor released a newer version 3.1.0.
However, the latest
version are still vulnerable to the above vulnerabilities.
Vendor contact timeline:
------------------------
2020-05-06: Contacting vendor through
2020-05-13: Follow-up with vendor; no response
2020-05-21: Follow-up with vendor; no response
2020-06-02: Follow-up with vendor; no response
2020-06-19: Follow-up with vendor; no response
2020-06-30: Tested the vulnerabilities in the latest version
(3.1.0) that is
available on vendor's webpage, still affected.
2020-07-17: Public release of security advisory
Solution:
---------
The vendor did not respond to our communication attempts, hence no
patch is
available.
Workaround:
-----------
None
Advisory URL:
-------------
https://www.sec-consult.com/en/vulnerability-lab/advisories/index.html
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
SEC Consult Vulnerability Lab
SEC Consult
Europe | Asia | North America
About SEC Consult Vulnerability Lab
The SEC Consult Vulnerability Lab is an integrated part of SEC
Consult. It
ensures the continued knowledge gain of SEC Consult in the field of
network
and application security to stay ahead of the attacker. The SEC
Consult
Vulnerability Lab supports high-quality penetration testing and the
evaluation
of new offensive and defensive technologies for our customers.
Hence our
customers obtain the most current information about vulnerabilities
and valid
recommendation about the risk profile of new technologies.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Interested to work with the experts of SEC Consult?
Send us your application
https://www.sec-consult.com/en/career/index.html
Interested in improving your cyber security with the experts of
SEC Consult?
Contact our local offices
https://www.sec-consult.com/en/contact/index.html
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Mail: research at sec-consult dot com
Web: https://www.sec-consult.com
Blog: http://blog.sec-consult.com
Twitter: https://twitter.com/sec_consult
EOF C. Phang / @2020
Read more https://packetstormsecurity.com/files/158468/SA-20200717-0.txt
