AOH :: HP Unsorted E :: TB10839.HTM

eFileCabinet Authentication Bypass



eFileCabinet Authentication Bypass
eFileCabinet Authentication Bypass



Title
-----
eFileCabinet Authentication Bypass

Severity
--------
Medium

Date Discovered
---------------
12/20/2006

Vendor Notified
---------------
3/26/2007

Discovered By
-------------
Digital Defense, Inc. Vulnerability Research Team
 - sxkeebler

Vulnerability Description
-------------------------
The eFileCabinet software suite is used to house digital images of files.  Though the eFileCabinet HTTP interface is password protected, it is possible to bypass said access controls to gain partial access to the eFileCabinet software.  In order to bypass security, an attacker must supply a non-existent filecabinetnumber, such as 0.  An attacker can utilize this access to partially navigate the eFileCabinet HTTP interface.  Successful exploitation of this flaw could allow an attacker to create efileCabinet drawers or to potentially obtain access to sensitive information.  

Solution Description
--------------------
The vendor has been notified of this flaw but has not provided a patch.  For more information concerning the eFileCabinet Authentication Bypass flaw, please contact eFileCabinet.  


Tested Systems / Software (with versions)
-----------------------------------------
Confirmed on Version 3.3.  Other versions may be vulnerable.

Vendor Name
-----------
EFileCabinet

Vendor Website
-------
http://www.efilecabinet.com/ 

The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH
We do not send spam. If you have received spam bearing an artofhacking.com email address, please forward it with full headers to abuse@artofhacking.com.