bugtraq - Menu Manager Mod for WebAPP

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: 12 Jun 2007 20:52:45 -0000
From: web-app@...mail.com
To: bugtraq@...urityfocus.com
Subject: Menu Manager Mod for WebAPP - No Input Filtering

There is a system access vulnerability in the Menu Manager Mod for WebAPP. This mod is available at http://www.2xlnt.com/webapp/development/app.cgi?action=downloadinfo&cat=webappmods&id=3 .

System commands can be entered in user's personal menus. Any system command works there and allows reading of any private file or creating or deleting any file on server.

Example: Entering a string in the title of an item on a user's personal menu allows them to read the WebAPP script configuration file:

";system("cat $scriptdir/conf/config.dat");"

(entered WITH quotes)

This exploit does not work for servers that prevent system commands from being used.

The Menu Manager Mod was built in to core code of WebAPP in 2006, and the vulnerability also exists in the "WebAPP NE" script that is being distributed from web-app.net, in all known versions 0.9.9.3.3, 0.9.9.3.4, and upwards.

The current WebAPP core code Menu Manager system is now secured regarding this issue in WebAPP versions 0.9.9.7 and before, from the WebAPP site at http://www.web-app.org/cgi-bin/index.cgi .