CVE-2020-36051
📋 TL;DR
This directory traversal vulnerability in MiniCMS V1.10 allows remote attackers to read arbitrary files on the server by manipulating the state parameter in page_edit.php. Any organization running MiniCMS V1.10 is affected, potentially exposing sensitive configuration files, credentials, or other server data.
💻 Affected Systems
- MiniCMS
📦 What is this software?
Minicms by 1234n
⚠️ Risk & Real-World Impact
Worst Case
Attackers could read sensitive server files like /etc/passwd, configuration files containing database credentials, or source code, leading to complete system compromise.
Likely Case
Attackers will read configuration files to extract database credentials and other sensitive information, then use that data for further attacks.
If Mitigated
With proper file permissions and web server configuration, impact is limited to readable files within the web application context.
🎯 Exploit Status
Exploitation requires access to the admin interface (page_edit.php), but no authentication bypass is needed beyond that access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: V1.11 or later
Vendor Advisory: https://github.com/bg5sbk/MiniCMS/issues/39
Restart Required: No
Instructions:
1. Download latest MiniCMS version from GitHub. 2. Backup current installation. 3. Replace all files with new version. 4. Verify functionality.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to filter directory traversal sequences in state parameter
Edit page_edit.php to add: if (strpos($_GET['state'], '..') !== false) { die('Invalid input'); }
Access Restriction
linuxRestrict access to page_edit.php to trusted IP addresses only
Add to .htaccess: Order Deny,Allow\nDeny from all\nAllow from 192.168.1.0/24
🧯 If You Can't Patch
- Implement WAF rules to block directory traversal patterns in URLs
- Restrict file system permissions to minimum required for web application
🔍 How to Verify
Check if Vulnerable:
Test by accessing page_edit.php?state=../../../../etc/passwd and checking if file contents are returnedCheck Version:
Check MiniCMS version in admin panel or readme.txt fileVerify Fix Applied:
Attempt the same test after patching - should receive error or no file contents📡 Detection & Monitoring
Log Indicators:
- Multiple requests to page_edit.php with ../ patterns in parameters
- Unusual file access patterns from web server process
Network Indicators:
- HTTP requests containing ../ or ..\ sequences in URL parameters
SIEM Query:
web.url:*page_edit.php* AND web.param:*..*