Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86369449

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: Redaxo CMS Mediapool Addon < 5.5.1 - Arbitrary File Upload
# Date: 2018-06-13
# Exploit Author: mn@HackerWerkstatt
# Vendor Homepage: https://redaxo.org
# Software Link: https://redaxo.org/download/redaxo/5.5.1.zip
# Version: 5.5.1 and older
# Tested on: LinuxMint
# More: Login required

### PoC ###

In the REDAXO CMS under version 5.6.0 the mediapool addon is vuln. Users who have an user-account, like editor, 
can use the mediapool to upload files. The mediapool addon under version 2.4.0 uses a blacklist for fileupload. 
For users it isn't possible upload files named: php, php4, php5, php6 or php7.

But, if you name the files like php71 or php53 the blacklist-function ignore this and upload of shellcode-file is possible.

https://example.com/redaxo/index.php?page=mediapool/media

### Fixed in mediapool 2.4.0 and Redaxo CMS 5.6.0
### reported: 08.03.2018
### fixed: 08.06.2018