Vulnerability in edittag.pl

2007.10.16
Credit: kers0r
Risk: Medium
Local: No
Remote: Yes
CWE: N/A


CVSS Base Score: 5/10
Impact Subscore: 2.9/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: None
Availability impact: None

EditTag is a script which facilitates website content management. EditTag allows users to edit pages using a web interface, but restricts editing to specific tagged areas of the document. This feature enables website managers to create a way for content authors who may not know HTML to update a web page in real time without having to worry about adversely affecting the underlying HTML code. The website is here http://www.thebilberry.com/greg/edittag/ The problem with the script lies in the fact that it can be easily tricked into allowing any file to be called up from the remote server. An example exploit is as follows: http://www.anything.com/edittag/edittag.cgi?file=%2F..%2F..%2F..%2F..%2F ..%2Fetc/passwd This example will grab the passwd file from the remote webserver, this is potentially dangerous. The vendor has been contacted


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2022, cxsecurity.com

 

Back to Top