CVE-2015-6567 (PHP, published 2017-04-14T16:59Z)
Description: value: Wolf CMS before 0.8.3.1 allows unrestricted file upload and PHP Code Execution because admin/plugin/file_manager/browse/ (aka the filemanager) does not validate the parameter "filename" properly. Exploitation requires a registered user who has access to upload functionality.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/wolfcms/wolfcms
Files changed:
wolf/plugins/file_manager/FileManagerController.php
wolf/plugins/file_manager/i18n/en-message.php
wolf/plugins/file_manager/views/index.php
wolf/plugins/file_manager/views/view.php
Commit message: Fix #619 and #625


Vulnerable code:
 * 
            'dir' => $this->path,
        
        
        
        
        
        
        
        
        
        
        
        
                
                
            
    
        
        
);
  $paths = explode('/', $dir); 
      $out .= '<a href="'.get_url('plugin/file_manager/browse/'.rtrim($progres_path, '/')).'">'.$path.'</a>/';
    <form action="<?php echo get_url('plugin/file_manager/chmod'); ?>" method="post"> 
        <input id="chmod_file_mode" maxlength="4" name="file[mode]" type="text" value="" /> 
      <form action="<?php echo get_url('plugin/file_manager/rename'); ?>" method="post"> 
          <input id="rename_file_new_name" maxlength="50" name="file[new_name]" type="text" value="" /> 
  $paths = explode('/', $filename); 
      $out .= '<a href="'.get_url('plugin/file_manager/browse/'.rtrim($progres_path, '/')).'">'.$path.'</a>/';

Fixed code:
 *
    static function htmlContextCleaner($input) {
        $bad_chars = array("<", ">");
        $safe_chars = array("&lt;", "&gt;");
        $output = str_replace($bad_chars, $safe_chars, $input);

        return stripslashes($output);
    }

            'dir' => htmlContextCleaner($this->path),










        $ext = strtolower(pathinfo($filename, PATHINFO_EXTENSION));
        if (in_array($ext, ['php', 'php3', 'php4', 'inc'])) {
            Flash::set('error', __('Not allowed to upload files with extension :ext', $ext));
            redirect(get_url('plugin/file_manager/browse/'));
        }



        // Check if trying to rename to php file (.php / .php3 etc)
        $ext = strtolower(pathinfo($data['new_name'], PATHINFO_EXTENSION));

        if (in_array($ext, ['php', 'php3', 'php4', 'inc'])) {
            Flash::set('error', __('Not allowed to rename to :ext', $ext));
            redirect(get_url('plugin/file_manager/browse/' . $path));
        }







    'Not allowed to upload files with extension :ext' => 'Not allowed to upload files with extension :ext',
    'Not allowed to rename to :ext' => 'Not allowed to rename to :ext',
);
function htmlContextCleaner($input) {
    $bad_chars = array("<", ">");
    $safe_chars = array("&lt;", "&gt;");
    $output = str_replace($bad_chars, $safe_chars, $input);

    return stripslashes($output);
}

  $paths = explode('/', $dir);
      $path = preg_replace('/.*:\/\/[^\/]+\//', '/', $path);
      $out .= '<a href="'.get_url('plugin/file_manager/browse/'.rtrim($progres_path, '/')).'">'.htmlContextCleaner($path).'</a>/';
    <form action="<?php echo get_url('plugin/file_manager/chmod'); ?>" method="post">
        <input id="chmod_file_mode" maxlength="4" name="file[mode]" type="text" value="" />
      <form action="<?php echo get_url('plugin/file_manager/rename'); ?>" method="post">
          <input id="rename_file_new_name" maxlength="50" name="file[new_name]" type="text" value="" />
function htmlContextCleaner($input) {
    $bad_chars = array("<", ">");
    $safe_chars = array("&lt;", "&gt;");
    $output = str_replace($bad_chars, $safe_chars, $input);

    return stripslashes($output);
}


  $paths = explode('/', $filename);
      $path = preg_replace('/.*:\/\/[^\/]+\//', '/', $path);
      $out .= '<a href="'.get_url('plugin/file_manager/browse/'.rtrim($progres_path, '/')).'">'.htmlContextCleaner($path).'</a>/';