bugtraq - CMME Multiple Information disclosure vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20081004114724.mxsjg4pduswssow4@mail.amnpardaz.com>
Date: Sat, 04 Oct 2008 11:47:24 +0330
From: admin@...report.ir
To: bugtraq@...urityfocus.com
Subject: CMME Multiple Information disclosure vulnerabilities

########################## WwW.BugReport.ir  
###########################################
#
#      AmnPardaz Security Research & Penetration Testing Group
#
# Title: CMME Multiple Information disclosure vulnerabilities
# Vendor: http://cmme.oesterholt.net
# Bug: Information Disclosure
# Vulnerable Version: 1.19 (prior versions also may be affected)
# Exploitation: Remote with browser
# Exploit: Available
# Fix Available: No!
# Original Advisory: http://www.bugreport.ir/index_55.htm
###################################################################################

####################
- Description:
####################

Quote from vendor: CMME means "Content Management Made Easy". It is a  
web content management system that is easy to use, doesn't have a lot  
of requirements

and allows for reasonable flexibility.

####################
- Vulnerability:
####################

There are multiple vulnerabilities in CMME , which can be exploited by  
malicious people to disclose potentially sensitive information.
these can be exploited to read the contents of data files on the  
server via a specially crafted URL, without requiring a valid login.

+-->Users Information Disclosure (Including MD5 Hashes)

POC: http://example.com/cmme/data/admin/users

+-->Server Informaion (phpinfo)

POC: http://example.com/cmme/info.php

+-->The Last generated server backup

POC: http://example.com/cmme/backup/cmme_data.zip

####################
- Solution:
####################

Restrict and grant only trusted users access to the resources.

####################
- Credit :
####################
AmnPardaz Security Research & Penetration Testing Group
Contact: admin[4t}bugreport{d0t]ir
WwW.BugReport.ir
WwW.AmnPardaz.com