Headline
CVE-2021-28428: GitHub - ttimot24/HorizontCMS: Lightweight CMS built on Laravel 8, VueJs 2.6 and Bootstrap 5.1. An alternative platform to OctoberCMS
File upload vulnerability in HorizontCMS before 1.0.0-beta.3 via uploading a .htaccess and *.hello files using the Media Files upload functionality. The original file upload vulnerability (CVE-2020-27387) was remediated by restricting the PHP extensions; however, we confirmed that the filter was bypassed via uploading an arbitrary .htaccess and *.hello files in order to execute PHP code to gain RCE.
HorizontCMS
HorizontCMS is an open-source, responsive Content Management System (CMS) built on Laravel 8, VueJs 2.6 and Bootstrap 5.1 which you can use to build you next generation websites and blogs.
This lightweight CMS platform provides end-users with the tools to extend and build sustainable web presence with one click which makes it easy to learn for users, simple to code for developers
Latest version: v1.0.0-beta.2****Try out
Frontend: http://horizontcms.herokuapp.com/
Backend: http://horizontcms.herokuapp.com/admin
Username & password: admin/admin
Installation****Browser
After downloading and copying the files to the server, navigate to the app root folder and run composer install. Then head to your domain. HorizontCMS can recognize if not installed yet, and redirects you to the installer. Follow the instructions, add the required credentials and you’re done.
Console
- Download the CMS
- Navigate to the app root folder and run
composer install - Run
php artisan horizontcms:install - Enter the required database and administrator informations.
- You’re finished.
Migration information
Incremented migrations will be in use after v1.0 is released. Until then migration files might be modified.
Install manually from scratch
Website For Students Tutorial
Docker Image
https://hub.docker.com/repository/docker/ttimot24/horizont-cms
Sample plugin
GoogleMaps
Contributing
- Create a Theme or Plugin
- Create translation
- Help in the docs.
- Write tests
- Report issues, send pull requests
- Tell what you think!
Any help is appreciated!
Donation
If this project makes your website development easier, you can buy me a coffe. :)
Project by Timot Tarjani (@ttimot24)