Full Disclosure mailing list archives
CVE-2014-8558 - JExperts Tecnologia - Channel Software Escalation Access Issues
From: Luciano Pedreira <lpedreira () gmail com>
Date: Wed, 5 Nov 2014 10:35:41 -0300
CVE-2014-8558 - JExperts Tecnologia / Channel Software Escalation Access Issues Vendor Notified: 2014-10-27 INTRODUCTION: The Channel Platform is an enterprise software project management (or project management) developed by Brazilian company JExperts Technology and present at thousands clients private enterprise and government enterprise. This software consists of an integrated set of solutions in the areas of strategy, projects and processes. This problem was confirmed in the following versions of the Channel, other versions maybe also affected. Version: 5.0.33_CCB DETAILS: The Channel software is affected by Escalation Access. The variables "action" and "key" can be manipulate by the GET method (passing parameters at the URL itself), where a user, with restricted access, such as "read only", can realize access to any other request of the call center of a user other than him and even create or edit existing content posted of other users. A logged with any user at the system, just change the parameter of the action ("action" variable) and the value of the key ("key" variable) to be manipulated to get unauthorized access to the areas of others users. Examples: [1] set action to "acompanhar" and key to "201" http://<server>/channel/ticket.do?action=acompanhar&key=201 [2] set action to "editar" and key to "100" http://<server>/channel/ticket.do?action=editar&key=100 CREDITS: This vulnerability was discovered and researched by Luciano Pedreira (a.k.a. shark) _______________________________________________ Sent through the Full Disclosure mailing list http://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Current thread:
- CVE-2014-8558 - JExperts Tecnologia - Channel Software Escalation Access Issues Luciano Pedreira (Nov 06)