The_Arhitect Posted March 21, 2012 Report Posted March 21, 2012 OneFileCMS - Failure to Restrict URL Access# Exploit Title: OneFileCMS - Failure to Restrict URL Access# Date: 12th March 2012# Author: Abhi M Balakrishnan# Software Link: https://raw.github.com/rocktronica/OneFileCMS/f265961d0646890c9efe05b93983124abc18c56e/onefilecms.php# Version: upto 1.1.4# Tested on: Apache-2.2.17, PHP-5.2.17, MySQL-5.5.9, Windows 6.2# Vulnerability Status: Fixed on version 1.1.5. Developer was very quick in responding to mails and to fix the issue. Bugfix version released within minutes after the notification. Great work.!!! Commit: https://github.com/rocktronica/OneFileCMS/commit/a4e36213d9fe3efccc2f6730d29fd2a05c57594b# Vulnerability: Failure to Restrict URL Access, since the redirection mechanism can be bypassed easily# Exploit: Step 1: Create a rule in No-Redirect Add-on: ^http://example.com/path/ Step 2: Access http://example.com/path/admin.php# PoC Video: http://www.youtube.com/watch?v=0lPz24Z7Q_4Sursa: OneFileCMS - Failure to Restrict URL Access Quote
