bugtraq - Remote access vulnerability using BigDump ver. 0.29b

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <200811060845.mA68j8dp006338@www5.securityfocus.com>
Date: Thu, 6 Nov 2008 01:45:08 -0700
From: XiaShing@...il.com
To: bugtraq@...urityfocus.com
Subject: Remote access vulnerability using BigDump ver. 0.29b

============================================================
!vuln
BigDump ver. 0.29b
Previous versions may also be affected.
============================================================

============================================================
!risk
Medium
There are currently many websites circulating with BigDump
enabled.
============================================================

============================================================
!dork
Dork: intitle:"BigDump ver. 0.29b"
============================================================

============================================================
!discussion
A user is able to successfully upload files onto a server by
uploading a php shell such as c99.php, by renaming it 
c99.php.sql
============================================================

============================================================
!solution
Do not use BigDump or put non-root/guest permissions on the
folder containing BigDump. The vendor has not yet been 
notified.
============================================================

============================================================
!greetz
Greetz go out to the people who know me.
============================================================

============================================================
!author
Xia Shing Zee
============================================================