Papoo CMS 3.6 - Access Restriction Bypass

2007.07.03
Risk: High
Local: No
Remote: Yes
CWE: CWE-Other


CVSS Base Score: 6.8/10
Impact Subscore: 6.9/10
Exploitability Subscore: 8/10
Exploit range: Remote
Attack complexity: Low
Authentication: Single time
Confidentiality impact: Complete
Integrity impact: None
Availability impact: None

Papoo Content Management System Backend Access Restriction Bypass Jun 24 2007 ________________________________________________________________________ _______ * Product Papoo Content Management System * Vulnerable Versions Papoo 3.6 and maybe prior * Vendor Status The Vendor was notified and the issue was fixed. A patch is available at http://www.papoo.de/index/menuid/204/reporeid/215 * Details The Papoo Content Management System provides several administration plugins in order to switch the application into debug mode or to create a database backup, for instance. By default, the plugins are only available to the administrator. The application however fails to check the user's privileges and allows any userwith access to the backend to access these administration pages. the database backup plugin dumps the whole database into a file that can be reviewed afterwards. The dump can also include the complete user table with all usernames and password hashes. The backup page can be directly accessed via: http://example.org/interna/plugin.php? template=devtools/templates/newdump_backend.html * Impact Attackers may be able to access the administration plugins and for instance create or remove plugins or to dump the database and get password hashes from the backup file. * Exploit No exploit required. ________________________________________________________________________ _______ Nico Leidecker - http://www.leidecker.info _____________________________________________________________________ Der WEB.DE SmartSurfer hilft bis zu 70% Ihrer Onlinekosten zu sparen! http://smartsurfer.web.de/?mc=100071&distributionid=000000000066


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2021, cxsecurity.com

 

Back to Top