Papoo CMS 3.6 - Access Restriction Bypass



Papoo Content Management System Backend Access Restriction Bypass Jun 24 2007
_______________________________________________________________________________


* Product

Papoo Content Management System


* Vulnerable Versions

Papoo 3.6 and maybe prior


* Vendor Status

The Vendor was notified and the issue was fixed.
A patch is available at http://www.papoo.de/index/menuid/204/reporeid/215


* Details

The Papoo Content Management System provides several administration plugins
in order to switch the application into debug mode or to create a database
backup, for instance. By default, the plugins are only available to the
administrator. The application however fails to check the user's privileges
and allows any userwith access to the backend to access these administration
pages.

the database backup plugin dumps the whole database into a file that can be
reviewed afterwards. The dump can also include the complete user table with
all usernames and password hashes. The backup page can be directly accessed
via:

http://example.org/interna/plugin.php?
template=devtools/templates/newdump_backend.html

* Impact

Attackers may be able to access the administration plugins and for instance
create or remove plugins or to dump the database and get password hashes
from the backup file.


* Exploit

No exploit required.


_______________________________________________________________________________

Nico Leidecker - http://www.leidecker.info

_____________________________________________________________________
Der WEB.DE SmartSurfer hilft bis zu 70% Ihrer Onlinekosten zu sparen!
http://smartsurfer.web.de/?mc=100071&distributionid=000000000066



Relevant Pages

  • [Full-disclosure] Papoo CMS 3.6 - Access Restriction Bypass
    ... Papoo Content Management System Backend Access Restriction Bypass Jun 24 2007 ... The Papoo Content Management System provides several administration plugins ... backup, for instance. ...
    (Full-Disclosure)
  • Papoo CMS - Multiple Cross Site Scripting
    ... Papoo Content Management System Multiple Cross Site Scriptings Jun 12 2007 ... The Vendor was notified and the issue fixed. ...
    (Bugtraq)
  • [Full-disclosure] Papoo CMS - Multiple Cross Site Scripting
    ... Papoo Content Management System Multiple Cross Site Scriptings Jun 12 2007 ... The Vendor was notified and the issue fixed. ...
    (Full-Disclosure)
  • [Full-disclosure] Papoo CMS 3.6 - SQL Injection
    ... Papoo Content Management System ... The Vendor was notified and the issue was fixed. ... The Papoo Content Management System is prone to an SQL Injection that can be ... The application will get the read and publish privileges for every usergroup ...
    (Full-Disclosure)
  • Papoo CMS 3.6 - SQL Injection
    ... Papoo Content Management System ... The Vendor was notified and the issue was fixed. ... The Papoo Content Management System is prone to an SQL Injection that can be ... The application will get the read and publish privileges for every usergroup ...
    (Bugtraq)