CVE-2020-36052
📋 TL;DR
This directory traversal vulnerability in MiniCMS V1.10 allows remote attackers to include and execute arbitrary files via the state parameter in post-edit.php. This can lead to remote code execution, affecting all users running the vulnerable version of MiniCMS.
💻 Affected Systems
- MiniCMS
📦 What is this software?
Minicms by 1234n
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, and potential lateral movement within the network.
Likely Case
Remote code execution allowing attackers to upload webshells, deface websites, or steal sensitive data from the server.
If Mitigated
Limited impact if proper input validation and file inclusion restrictions are implemented.
🎯 Exploit Status
The vulnerability is simple to exploit with publicly available proof-of-concept code. Attackers can easily craft malicious requests to execute arbitrary code.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: V1.11 or later
Vendor Advisory: https://github.com/bg5sbk/MiniCMS/issues/38
Restart Required: No
Instructions:
1. Download the latest version of MiniCMS from the official repository. 2. Backup your current installation. 3. Replace all files with the updated version. 4. Verify that the post-edit.php file has proper input validation.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to filter directory traversal sequences in the state parameter
Edit post-edit.php and add: if (strpos($_GET['state'], '..') !== false) { die('Invalid input'); }
File Inclusion Restriction
allRestrict file inclusion to specific allowed directories only
Modify file inclusion logic to use absolute paths and check against whitelist
🧯 If You Can't Patch
- Implement a web application firewall (WAF) with rules to block directory traversal patterns
- Restrict network access to the MiniCMS instance using firewall rules
🔍 How to Verify
Check if Vulnerable:
Check if your MiniCMS version is 1.10 by examining the version file or checking the admin panelCheck Version:
Check the version.txt file or login to MiniCMS admin panelVerify Fix Applied:
After updating, test the post-edit.php endpoint with directory traversal payloads to ensure they're blocked📡 Detection & Monitoring
Log Indicators:
- HTTP requests to post-edit.php with state parameter containing '..' or '../' sequences
- Unusual file inclusion attempts in web server logs
Network Indicators:
- HTTP requests with directory traversal patterns in the state parameter
- Unexpected file downloads or inclusions from the web server
SIEM Query:
source="web_server_logs" AND uri="*post-edit.php*" AND (state="*..*" OR state="*../*")