Brief of this vulnerability
ClipperCMS allows to upload .htaccess. It is able to execute the any types of the extensions as PHP scripts.
Test Environment
Apache/2.4.18 (Debian)
PHP 5.6.38-2+ubuntu16.04.1+deb.sury.org+1 (cli)
Affect version
1.3.3
Reason of This Vulnerability
.htaccess is allowed to upload in your default whitelist.
It should be removed in default whitelist.
It can change the access configuration about current directory and subdirectories.
Even this file can drive to execute any extensions as PHP script.
This vulnerability needs admin credentials, but it can be used to get system shell to adversary who get the admin authority using other attack( e.g. XSS ).
The text was updated successfully, but these errors were encountered:
Brief of this vulnerability
ClipperCMS allows to upload .htaccess. It is able to execute the any types of the extensions as PHP scripts.
Test Environment
Affect version
1.3.3
Reason of This Vulnerability
.htaccess is allowed to upload in your default whitelist.
It should be removed in default whitelist.
It can change the access configuration about current directory and subdirectories.
Even this file can drive to execute any extensions as PHP script.
This vulnerability needs admin credentials, but it can be used to get system shell to adversary who get the admin authority using other attack( e.g. XSS ).
The text was updated successfully, but these errors were encountered: