Navigatecms Navigate CMS 2.8.5 Configuration File navigate_download.php ID path traversal

Summaryinfo

A vulnerability was found in Navigatecms Navigate CMS 2.8.5. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file navigate_download.php of the component Configuration File Handler. Such manipulation of the argument ID leads to path traversal. This vulnerability is listed as CVE-2018-25393. The attack may be performed from remote. In addition, an exploit is available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Navigatecms Navigate CMS 2.8.5 and classified as problematic. Affected by this issue is some unknown processing of the file navigate_download.php of the component Configuration File Handler. The manipulation of the argument id with an unknown input leads to a path traversal vulnerability. Using CWE to declare the problem leads to CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Impacted is confidentiality. CVE summarizes:

Navigate CMS 2.8.5 contains a path traversal vulnerability that allows authenticated users to download arbitrary files by injecting directory traversal sequences in the id parameter. Attackers can send GET requests to navigate_download.php with path traversal payloads ../../../cfg/globals.php to access sensitive configuration files and system files outside the intended directory.

The weakness was presented by Ihsan Sencan as 45615. The advisory is shared for download at exploit-db.com. This vulnerability is handled as CVE-2018-25393 since 05/29/2026. The exploitation is known to be easy. The attack may be launched remotely. Technical details as well as a public exploit are known. The MITRE ATT&CK project declares the attack technique as T1006.

The exploit is available at exploit-db.com. It is declared as proof-of-concept. By approaching the search of inurl:navigate_download.php it is possible to find vulnerable targets with Google Hacking.

Upgrading eliminates this vulnerability. The upgrade is hosted for download at master.dl.sourceforge.net.

The vulnerability is also documented in the vulnerability database at Exploit-DB (45615). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Content Management System

Vendor

• Navigatecms

Name

• Navigate CMS

Version

• 2.8.5

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion