CVE-2022-26271 Scanner
CVE-2022-26271 Scanner - Arbitrary File Read vulnerability in 74cms
Short Info
Level
High
Single Scan
Single Scan
Can be used by
Asset Owner
Estimated Time
10 seconds
Time Interval
11 days 14 hours
Scan only one
URL
Toolbox
-
74cms is a content management system used for building and managing websites. It is commonly utilized by developers for creating various types of web applications, including blogs, forums, and e-commerce sites. The platform has various versions that are vulnerable to a range of security issues, particularly in older releases. The vulnerability discussed in this scanner impacts version 3.4.1. This software is widely used for its simplicity and ease of use, but older versions may be susceptible to various exploits. The vulnerability in question is related to arbitrary file reading, which can lead to unauthorized access to sensitive data.
The vulnerability discovered in 74cms v3.4.1 allows attackers to read arbitrary files on the server. This is possible through improper handling of the '$url' parameter in the Download.php file. If exploited, attackers can gain unauthorized access to sensitive files like configuration files, database credentials, or other critical information. The issue exists in the product’s handling of user input and its failure to properly sanitize file paths. This vulnerability makes the affected systems prone to further exploitation if not mitigated quickly. This issue highlights the importance of securing file handling in web applications.
The vulnerability arises from the '$url' parameter in the 'Download.php' file, which fails to sanitize the user-supplied input. By crafting a specific request, an attacker can manipulate the file path and read arbitrary files on the system. For example, the attacker could exploit this vulnerability by sending a request such as '/index/download/index?name=index.php&url=../../application/database.php'. This would allow the attacker to retrieve the contents of sensitive files like 'database.php'. The vulnerability is specific to the handling of the '$url' parameter and can be easily triggered by unauthenticated users. Proper validation and sanitization of file paths would have prevented this issue.
If exploited, the attacker can gain access to sensitive files on the server, such as configuration files or database credentials. This can lead to further attacks like data theft, privilege escalation, or complete server compromise. An attacker may gain unauthorized administrative access to the website or web application, potentially altering content or damaging the integrity of the system. Additionally, this type of vulnerability can have legal and reputational consequences for organizations affected by it. The exposure of sensitive information can lead to data breaches or compliance violations. The risk can be mitigated by promptly applying available patches or upgrading to a secure version of the software.
REFERENCES
