SB2017060101 - Multiple vulnerabilities in PivotX

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Unrestricted file upload (CVE-ID: CVE-2017-8402)

The vulnerability allows a remote attacker to execute arbitrary PHP code on the target system.

The vulnerability exists due to insufficient validation of the uploaded files in "/pivotx/fileupload.php" script. A remote authenticated attacker can upload a specially crafted .htaccess files on the system and use it to execute arbitrary PHP code.

Successful exploitation may allow an attacker to compromise vulnerable website.

2) Resource management error (CVE-ID: CVE-2017-7570)

The vulnerability allows a remote attacker to execute arbitrary PHP code on the target system.

The vulnerability exists due to insufficient error handling when processing file uploads for files with identical names. A remote authenticated attacker can upload a file with same extension (e.g. ".jpg") and then invoke a duplicate function to change the file extension to .php.

Successful exploitation may allow an attacker to compromise vulnerable website.

3) Unrestricted file upload (CVE-ID: CVE-2017-14958)

The vulnerability allows a remote attacker to execute arbitrary PHP code on the target system.

The vulnerability exists due to insufficient validation of the uploaded files in "lib.php" script. A remote authenticated administrator can upload and execute arbitrary .php script.

Successful exploitation may allow an attacker to compromise vulnerable website.

Remediation

Install update from vendor's website.

References

• https://sourceforge.net/p/pivot-weblog/code/4489/
• https://gist.github.com/X1nda/749b6aac6e080624d9f8ec81321335df
• https://sourceforge.net/p/pivot-weblog/code/4490/