EasyCafe Server <= 2.2.14 Remote File Read

[Rio Sherri <rio.sherri () fshnstudent info>]

# Title : EasyCafe Server <= 2.2.14 Remote File Read
# Date : 25/12/2015
# Author : R-73eN
# Tested on : Windows 7 Ultimate
# Software Link : http://www.tinasoft.com/easycafe/
# Vulnerable Versions : EasyCafe Server <= 2.2.14
# EasyCafe Server has a feature to upload file from the server to a client.
# And the request is as following. EasyCafe Server sends an UDP request to
the client with the file that wants to upload,
# Then the client receives the packet and connects to the server on port
831 and sends the directory of the file and receives it.
# The problem is that a remote attacker can connect to port 831 and can
retrive a file because the server doesn't validate the request,
# and does not check if it has sent the UDP request which gives us full
Read access to the system.

POC is attached.

Attachment: tinasoft.py
Description:

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/