full-disclosure - Browser Based File Manager Administration Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date: Sun May  8 23:25:25 2005
From: basher13 at linuxmail.org (eric basher)
Subject: Browser Based File Manager Administration
	Vulnerability

Date:
3:59 15/05/08

Subject:
" Browser Based File Manager Administration  Vulnerability "

Vulnerable version:
Browser Based File Manager 1.0

Description:
The Net56 File Manager application is completely browser based allowing you to focus 
on handling files and folders at remote locations using only a browser. By maintaining 
a state-of-the-art intranet, it ensures maximum efficiency, quality control and effective 
communication. With File Manager you can create new folders, upload files, move, rename 
and delete files all through a web browser and send shareable links to colleagues.

Vulnerability:
The administration page is so vulnerability to get access admin privallage.
Use method SQL Injection in the form admin login,after succesfull logged,
then we can run as Admininistration of website.
User may can upload malicious script,backdoors,trojan that can made run to the 
Administration system computer.

Sample of client:
./login.asp
On the login form use method SQL Injection:

Project ID : 001
User ID : admin
Password : 'or '='

W00t! we have g0t Admin land...

Solution:
Vendor had being contact

Vendor URL:
http://www.net56.net/Services/Application_Development_Services/
Browser_Based_File_Manager.asp

Credits:
Published by - basher13[basher13@...uxmail.org]
-- 
_______________________________________________
Check out the latest SMS services @ http://www.linuxmail.org
This allows you to send and receive SMS through your mailbox.

Powered by Outblaze