ForkCMS Directory Traversal Vulnerability in forkcms/forkcms
Summary
CVE-2012-1207: ForkCMS Directory Traversal vulnerability. Affects forkcms/forkcms versions < 3.2.5. Fixed in 3.2.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ForkCMS is an open-source content management system (CMS) written in PHP. It provides a platform for building and managing websites with various modules and functionalities. However, a directory traversal vulnerability has been discovered in Fork CMS version 3.2.4 and possibly earlier versions. This vulnerability allows remote attackers to read arbitrary files by exploiting a directory traversal flaw in the frontend/core/engine/javascript.php file, specifically in the frontend/js.php module parameter.
Vulnerability Detail
The directory traversal vulnerability in Fork CMS allows an attacker to bypass file access restrictions and read arbitrary files on the server. By including .. (dot dot) sequences in the module parameter of the frontend/js.php URL, an attacker can traverse directories and access files outside the intended scope. This can lead to unauthorized disclosure of sensitive information, such as configuration files, user data, or other confidential data stored on the server.
How To Fix
Minimum fixed version
3.2.5
This is the first release that contains the fix.
composer require forkcms/forkcms:3.2.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately possible, a temporary workaround can be implemented by modifying the affected file frontend/core/engine/javascript.php. The following code snippet demonstrates a possible fix:
// Add input validation to prevent directory traversal
$module = $_GET['module'];
if (strpos($module, '..') !== false) {
// Handle invalid input
exit('Invalid module parameter');
}
// Rest of the code
// ...
Conclusion
The directory traversal vulnerability in Fork CMS can allow remote attackers to read arbitrary files on the server. It is crucial to promptly update to the latest version of Fork CMS (3.2.5 or later) to fix this vulnerability. By upgrading, users can ensure that proper input validation and sanitization measures are in place to prevent directory traversal attacks. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for forkcms/forkcms →
FAQ
ForkCMS is an open-source content management system (CMS) written in PHP. It provides a platform for building and managing websites with various modules and functionalities.
A directory traversal vulnerability, also known as path traversal or dot dot slash attack, is a security flaw that allows an attacker to access files and directories outside the intended scope of an application. By manipulating input parameters, an attacker can traverse directories and read sensitive files on the server.
The directory traversal vulnerability in Fork CMS is present in the frontend/core/engine/javascript.php file. By including .. (dot dot) sequences in the module parameter of the frontend/js.php URL, an attacker can bypass file access restrictions and read arbitrary files on the server.
The directory traversal vulnerability in Fork CMS can lead to unauthorized disclosure of sensitive information stored on the server. This may include configuration files, user data, or other confidential data. Attackers can exploit this vulnerability to gather information for further attacks or to gain unauthorized access to the system.
To fix this vulnerability, it is recommended to upgrade to Fork CMS version 3.2.5 or later. The updated version includes proper input validation and sanitization to prevent directory traversal attacks. Users should update their Fork CMS installation to the latest version to mitigate the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for forkcms/forkcms.
