[Full-disclosure] Papoo CMS 3.6 - Access Restriction Bypass

Papoo Content Management System Backend Access Restriction Bypass Jun 24 2007

• Product

  Papoo Content Management System

• Vulnerable Versions

  Papoo 3.6 and maybe prior

• Vendor Status

  The Vendor was notified and the issue was fixed.
  A patch is available at http://www.papoo.de/index/menuid/204/reporeid/215

• Details

  The Papoo Content Management System provides several administration plugins
  in order to switch the application into debug mode or to create a database
  backup, for instance. By default, the plugins are only available to the
  administrator. The application however fails to check the user's privileges
  and allows any userwith access to the backend to access these administration
  pages.

  the database backup plugin dumps the whole database into a file that can be
  reviewed afterwards. The dump can also include the complete user table with
  all usernames and password hashes. The backup page can be directly accessed
  via:

  http://example.org/interna/plugin.php?
  template=devtools/templates/newdump_backend.html

• Impact

  Attackers may be able to access the administration plugins and for instance
  create or remove plugins or to dump the database and get password hashes
  from the backup file.

• Exploit

  No exploit required.

Nico Leidecker - http://www.leidecker.info

Erweitern Sie FreeMail zu einem noch leistungsstarkeren E-Mail-Postfach!
Mehr Infos unter http://produkte.web.de/club/?mc=021131

Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/