PHP Code Execution via change password function

[KietNA-68]

Dear @boiteasite,
I found a security problem can lead to remote code execution in CMSUno version 1.7.2

Description:

sauvePass action in {webroot}/uno/central.php file call to file_put_contents() function to write username to password.php file when user successfully changed password, Becase of filter without ' , " , ; , (), ... the attacker can inject malicious php code into password.php

PoC:

When submit username and password, php code will be executed

[boiteasite]

Hi KietNA,

Thank you very much for this report.
This is fixed ! V1.7.3.

Regards

[KietNA-68]

Hi KietNA,

Thank you very much for this report.
This is fixed ! V1.7.3.

Regards

Thanks for you reply