[Full-disclosure] Papoo CMS 3.6 - Access Restriction Bypass
- From: Nico Leidecker <nico@xxxxxxxxxxxxxx>
- Date: Sun, 24 Jun 2007 18:23:25 +0200
Papoo Content Management System Backend Access Restriction Bypass Jun 24 2007
Papoo Content Management System
* Vulnerable Versions
Papoo 3.6 and maybe prior
* Vendor Status
The Vendor was notified and the issue was fixed.
A patch is available at http://www.papoo.de/index/menuid/204/reporeid/215
The Papoo Content Management System provides several administration plugins
in order to switch the application into debug mode or to create a database
backup, for instance. By default, the plugins are only available to the
administrator. The application however fails to check the user's privileges
and allows any userwith access to the backend to access these administration
the database backup plugin dumps the whole database into a file that can be
reviewed afterwards. The dump can also include the complete user table with
all usernames and password hashes. The backup page can be directly accessed
Attackers may be able to access the administration plugins and for instance
create or remove plugins or to dump the database and get password hashes
from the backup file.
No exploit required.
Nico Leidecker - http://www.leidecker.info
Erweitern Sie FreeMail zu einem noch leistungsstärkeren E-Mail-Postfach!
Mehr Infos unter http://produkte.web.de/club/?mc=021131
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/
- Prev by Date: [Full-disclosure] Papoo CMS 3.6 - SQL Injection
- Next by Date: [Full-disclosure] Office 0day
- Previous by thread: [Full-disclosure] Papoo CMS 3.6 - SQL Injection
- Next by thread: [Full-disclosure] Office 0day