[FD] 4images 1.7.11: Code Execution

Security Advisory - Curesec Research Team 1. Introduction Affected Product: 4images 1.7.11 Fixed in: 1.7.12 Fixed Version Link: http://ift.tt/1NMG3Cf Vendor Website: http://ift.tt/XKxPm3 Vulnerability Type: Code Execution Remote Exploitable: Yes Reported to vendor: 09/29/2015 Disclosed to public: 11/04/2015 Release mode: Coordinated release CVE: Requested, but not assigned Credits Tim Coen of Curesec GmbH 2. Vulnerability Description CVSS High 9.0 AV:N/AC:L/Au:S/C:C/I:C/A:C Description 4images comes with a HTML Template editor which allows the editing of HTML files. But it will also create a new file if the passed file name does not already exist. When doing this, it does not check that the extension of the passed file is .html. Admin credentials are required to use the HTML template editor. 3. Proof of Concept POST /4images/admin/templates.php HTTP/1.1 __csrf=28a9a05b480c3f8ed326523b1ce7532c&action=savetemplate&content=