CVE-2018-7172 (PHP, published 2018-02-27T15:29Z)
Description: value: In index.php in WonderCMS before 2.4.1, remote attackers can delete arbitrary files via directory traversal.
Severity: MEDIUM (CVSS v3 base score: 4.9)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/robiso/wondercms
Files changed:
index.php
Commit message: Update index.php

- Fixed vulnerability - logged in admin could delete files from any directory (added realpath).
- Added SRI hashes to external JavaScript and CSS files: jquery.min.js, bootstrap.min.js, autosize.min.js, taboverride.min.js, jquery.taboverride.min.js, bootstrap.min.css).
- Removed uneccessarry session unset.
- Minor text changes.

Vulnerable code:
define('version', '2.4.0');
					if (!$filename || empty($filename)) {
						continue;
					}
					if ($filename == wCMS::get('config', 'theme')) {
						wCMS::alert('danger', 'Cannot delete currently active theme.');
						wCMS::redirect();
						continue;
					}
					if (file_exists("{$folder}/{$filename}")) {
						wCMS::recursiveDelete("{$folder}/{$filename}");
						wCMS::alert('success', "Deleted {$filename}.");
						wCMS::redirect();
<script src="https://cdn.jsdelivr.net/npm/autosize@4.0.0/dist/autosize.min.js"></script>
<script src="https://cdn.jsdelivr.net/npm/taboverride@4.0.3/build/output/taboverride.min.js"></script>
<script src="https://cdn.jsdelivr.net/npm/jquery.taboverride@4.0.0/build/jquery.taboverride.min.js"></script>
			unset($_SESSION['l'], $_SESSION['i'], $_SESSION['u'], $_SESSION['token']);
			wCMS::alert('info', '<b>New WonderCMS update available.</b><p>- Backup your website and check <a href="https://wondercms.com/whatsnew" target="_blank">what\'s new</a> before updating.</p><form action="' . wCMS::url(wCMS::$currentPage) . '" method="post" class="marginTop5"><button type="submit" class="btn btn-info" name="backup">Create backup</button><input type="hidden" name="token" value="' . wCMS::generateToken() . '"></form><form action="" method="post" class="marginTop5"><button class="btn btn-info" name="upgrade">Update WonderCMS</button><input type="hidden" name="token" value="' . wCMS::generateToken() . '"></form>', true);

Fixed code:
define('version', '2.4.1');
					$basePath = $folder . "/";
					$realBase = realpath($basePath);
					$userPath = $basePath . $filename;
					$realUserPath = realpath($userPath);
					if ($realUserPath != true || strpos($realUserPath, $realBase) === 0) {
						if (!$filename || empty($filename)) {
							continue;
						}
						if ($filename == wCMS::get('config', 'theme')) {
							wCMS::alert('danger', 'Cannot delete currently active theme.');
							wCMS::redirect();
							continue;
						}
						if (file_exists("{$folder}/{$filename}")) {
							wCMS::recursiveDelete("{$folder}/{$filename}");
							wCMS::alert('success', "Deleted {$filename}.");
							wCMS::redirect();
						}
<script src="https://cdn.jsdelivr.net/npm/autosize@4.0.0/dist/autosize.min.js" integrity="sha384-ne8qhd4dK8kbCS8Wj5TQeUmxPGohiEsOjjyycp/BBl3l3f8K11l9ggrTdNmoPkHc" crossorigin="anonymous"></script>
<script src="https://cdn.jsdelivr.net/npm/taboverride@4.0.3/build/output/taboverride.min.js" integrity="sha384-fYHyZra+saKYZN+7O59tPxgkgfujmYExoI6zUvvvrKVT1b7krdcdEpTLVJoF/ap1" crossorigin="anonymous"></script>
<script src="https://cdn.jsdelivr.net/npm/jquery.taboverride@4.0.0/build/jquery.taboverride.min.js" integrity="sha384-RU4BFEU2qmLJ+oImSowhm+0Py9sT+HUD71kZz1i0aWjBfPx+15Y1jmC8gMk1+1W4" crossorigin="anonymous"></script>
			unset($_SESSION['l'], $_SESSION['i'], $_SESSION['token']);
			wCMS::alert('info', '<b>New WonderCMS update available</b><p>- Backup your website and check <a href="https://wondercms.com/whatsnew" target="_blank"><u>what\'s new</u></a> before updating.</p><form action="' . wCMS::url(wCMS::$currentPage) . '" method="post" class="marginTop5"><button type="submit" class="btn btn-info" name="backup">Download backup</button><input type="hidden" name="token" value="' . wCMS::generateToken() . '"></form><form action="" method="post" class="marginTop5"><button class="btn btn-info" name="upgrade">Update WonderCMS</button><input type="hidden" name="token" value="' . wCMS::generateToken() . '"></form>', true);