Jump to content
Praetorian503

chillyCMS 1.3.0 Shell Upload / Access Bypass

Recommended Posts

chillyCMS version 1.3.0 suffers from URL restriction bypass and remote shell upload vulnerabilities.

# Exploit Title: chillyCMS 1.3.0 Multiple Vulnerabilities
# Google Dork: "powered by chillyCMS"
# Date: 15 February 2013
# Exploit Author: Abhi M Balakrishnan
# Vendor Homepage: http://chillycms.bplaced.net/
# Software Link: http://chillycms.bplaced.net/chillyCMS/media/files/chillyCMS_full.zip
# Version: 1.3.0
# Tested on: uWAMP 2.1 (PHP 5.2.17, MySQL 5.5.9), Windows 8
# Video: http://www.youtube.com/watch?v=6B3rND9S75g


# Vulnerability
Failure to Restrict URL Access
chillyCMS uses 302 redirects to restrict access to the unautorized pages.

# Exploit
Step 1: Create a rule in No-Redirect Add-on: ^http://localhost/chillyCMS/
Step 2: Access http://localhost/chillyCMS/admin/


# Vulnerability
Arbitrary File Upload
chillyCMS/admin/design.site.php page extracts all uploaded ZIP files to chillyCMS/tmp directory

# Exploit
Step 1: Create a ZIP file of the files to be uploaded. Example: Compress shell.php to get shell.zip
Step 2: Upload shell.zip
Step 3: Access the shell at http://localhost/chillyCMS/tmp/shell.php

# History
11 March 2012 - Discovered vulnerability and exploit, contacted the vendor.
12 March 2012 - Vendor responds back, exchanges few mails.
15 November 2012 - Vendor discontinues further development.
15 February 2013 - Published the vulnerabilities and exploits to the public.

# How to reproduce
The latest download from the website was not working on fresh install. An earlier version (1.1.3) has been installed and all the PHP files, except config.php, have been replaced with new files.

Source: PacketStorm

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.



×
×
  • Create New...