AOH :: HP Unsorted M :: TB11268.HTM

Menu Manager Mod for WebAPP - No Input Filtering



Menu Manager Mod for WebAPP - No Input Filtering
Menu Manager Mod for WebAPP - No Input Filtering



There is a system access vulnerability in the Menu Manager Mod for WebAPP. This mod is available at http://www.2xlnt.com/webapp/development/app.cgi?action=downloadinfo&cat=webappmods&id=3 . 
 
System commands can be entered in user's personal menus. Any system command works there and allows reading of any private file or creating or deleting any file on server.
 
Example: Entering a string in the title of an item on a user's personal menu allows them to read the WebAPP script configuration file:
 
";system("cat $scriptdir/conf/config.dat");"
 
(entered WITH quotes)
 
This exploit does not work for servers that prevent system commands from being used.
 
The Menu Manager Mod was built in to core code of WebAPP in 2006, and the vulnerability also exists in the "WebAPP NE" script that is being distributed from web-app.net, in all known versions 0.9.9.3.3, 0.9.9.3.4, and upwards.
 
The current WebAPP core code Menu Manager system is now secured regarding this issue in WebAPP versions 0.9.9.7 and before, from the WebAPP site at http://www.web-app.org/cgi-bin/index.cgi . 

The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH
We do not send spam. If you have received spam bearing an artofhacking.com email address, please forward it with full headers to abuse@artofhacking.com.