CVE-2014-9148

published 2017-10-16

CVE-2014-9148: Fiyo CMS 2.0.1.8 allows remote attackers to bypass intended access restrictions and execute the (1) "Install and Update" or (2) Backup super administrator…

Priority P2 68 critical 9.8 CVSS 3.0

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

Fiyo CMS 2.0.1.8 allows remote attackers to bypass intended access restrictions and execute the (1) "Install and Update" or (2) Backup super administrator function via the view parameter in a direct request to fiyo/dapur.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
fiyo	fiyo_cms	<= 2.0.1.8	—

Detection & IOCs extracted from sources · hover to see the quote

url http://192.168.248.132/fiyo/dapur/index.php?app=user&act=edit&id=1[sqli]↗

path /fiyo/dapur/apps/app_article/controller/article_list.php↗

path /fiyo/dapur/apps/app_user/controller/check_user.php↗

path /fiyo/dapur↗

path /fiyo//plugins/plg_kcfinder/browse.php↗

command dir=files&file=../../../../../../../etc/passwd↗

command act=user&username=test' AND SLEEP(5) AND 'UjqT'='UjqT↗

• → Detect direct unauthenticated GET requests to /fiyo/dapur with a 'view' parameter attempting to access Install/Update or Backup functions, which should require super administrator privileges. ↗
• → Monitor POST requests to /fiyo/dapur/apps/app_user/controller/check_user.php for SQL injection patterns in the 'username' parameter (e.g., SLEEP, UNION, boolean-based payloads). ↗
• → Detect directory traversal attempts via POST to /fiyo//plugins/plg_kcfinder/browse.php with 'file' parameter containing '../' sequences targeting /etc/passwd. ↗
• → Monitor GET requests to /fiyo/dapur/index.php with 'id' parameter containing SQL injection payloads such as UNION SELECT or SLEEP(). ↗
• → Monitor GET requests to /fiyo/dapur/apps/app_article/controller/article_list.php with SQL injection in 'cat', 'user', or 'level' parameters. ↗

• · The IP address 192.168.248.132 used in all PoC URLs is a private lab/test IP from the researcher's environment and is not an operational attacker infrastructure indicator. ↗
• · CVE-2014-9148 specifically covers the access control bypass via the 'view' parameter in direct requests to fiyo/dapur; the SQL injection and directory traversal PoCs in the same advisory correspond to CVE-2014-9145 and CVE-2014-1222 respectively. ↗

CVSS provenance

nvd v3.0 9.8 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-284