lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Sun, 24 Jun 2007 18:22:03 +0200
From: Nico Leidecker <nicoLeidecker@....de>
To: bugtraq@...urityfocus.com
Subject: Papoo CMS 3.6 - Access Restriction Bypass

Papoo Content Management System Backend Access Restriction Bypass   Jun 24 2007
_______________________________________________________________________________


* Product

  Papoo Content Management System


* Vulnerable Versions

  Papoo 3.6 and maybe prior

  
* Vendor Status

  The Vendor was notified and the issue was fixed.
  A patch is available at http://www.papoo.de/index/menuid/204/reporeid/215


* Details

  The Papoo Content Management System provides several administration plugins
  in order to switch the application into debug mode or to create a database 
  backup, for instance. By default, the plugins are only available to the 
  administrator. The application however fails to check the user's privileges 
  and allows any userwith access to the backend to access these administration 
  pages.

  the database backup plugin dumps the whole database into a file that can be 
  reviewed afterwards. The dump can also include the complete user table with 
  all usernames and password hashes. The backup page can be directly accessed 
  via:

    http://example.org/interna/plugin.php?
			   template=devtools/templates/newdump_backend.html

* Impact

  Attackers may be able to access the administration plugins and for instance 
  create or remove plugins or to dump the database and get password hashes 
  from the backup file.


* Exploit

  No exploit required.


_______________________________________________________________________________

Nico Leidecker - http://www.leidecker.info

_____________________________________________________________________
Der WEB.DE SmartSurfer hilft bis zu 70% Ihrer Onlinekosten zu sparen!
http://smartsurfer.web.de/?mc=100071&distributionid=000000000066

Powered by blists - more mailing lists