Full Disclosure mailing list archives
Browser Based File Manager Administration Vulnerability
From: "eric basher" <basher13 () linuxmail org>
Date: Mon, 09 May 2005 04:55:08 +0800
Date: 3:59 15/05/08 Subject: " Browser Based File Manager Administration Vulnerability " Vulnerable version: Browser Based File Manager 1.0 Description: The Net56 File Manager application is completely browser based allowing you to focus on handling files and folders at remote locations using only a browser. By maintaining a state-of-the-art intranet, it ensures maximum efficiency, quality control and effective communication. With File Manager you can create new folders, upload files, move, rename and delete files all through a web browser and send shareable links to colleagues. Vulnerability: The administration page is so vulnerability to get access admin privallage. Use method SQL Injection in the form admin login,after succesfull logged, then we can run as Admininistration of website. User may can upload malicious script,backdoors,trojan that can made run to the Administration system computer. Sample of client: ./login.asp On the login form use method SQL Injection: Project ID : 001 User ID : admin Password : 'or '=' W00t! we have g0t Admin land... Solution: Vendor had being contact Vendor URL: http://www.net56.net/Services/Application_Development_Services/ Browser_Based_File_Manager.asp Credits: Published by - basher13[basher13 () linuxmail org] -- _______________________________________________ Check out the latest SMS services @ http://www.linuxmail.org This allows you to send and receive SMS through your mailbox. Powered by Outblaze _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Browser Based File Manager Administration Vulnerability eric basher (May 08)