idreamsoft iCMS 7.0.11 ZIP File admincp.php?app=config path traversal

Summaryinfo

A vulnerability labeled as critical has been found in idreamsoft iCMS 7.0.11. Affected by this issue is some unknown functionality of the file admincp.php?app=config of the component ZIP File Handler. Such manipulation leads to path traversal. This vulnerability is documented as CVE-2018-16320. The attack can be executed remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in idreamsoft iCMS 7.0.11 (Content Management System) and classified as critical. Affected by this issue is an unknown part of the file admincp.php?app=config of the component ZIP File Handler. The manipulation with an unknown input leads to a path traversal vulnerability. Using CWE to declare the problem leads to CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Impacted is confidentiality, integrity, and availability. CVE summarizes:

idreamsoft iCMS 7.0.11 allows admincp.php?app=config Directory Traversal, resulting in execution of arbitrary PHP code from a ZIP file.

The bug was discovered 08/27/2018. The weakness was released 09/01/2018 (Website). The advisory is shared for download at github.com. This vulnerability is handled as CVE-2018-16320 since 09/01/2018. The exploitation is known to be easy. The attack may be launched remotely. A simple authentication is necessary for exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1006.

The vulnerability was handled as a non-public zero-day exploit for at least 5 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Entry connected to this vulnerability is available at VDB-123473. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Content Management System

Vendor

• idreamsoft

Name

• iCMS

Version

• 7.0.11

License

• free

Website

• Product: https://github.com/idreamsoft/iCMS/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion