Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!


TUCoPS :: Web :: CMS / Portals :: bx6080.htm

TAK cms vulns



Vulnerabilities in TAK cms
Vulnerabilities in TAK cms



Hello Bugtraq!

I want to warn you about security vulnerabilities in TAK cms. It's Ukrainian
commercial CMS.

-----------------------------
Advisory: Vulnerabilities in TAK cms
-----------------------------
URL: http://websecurity.com.ua/4050/ 
-----------------------------
Timeline:
04.02.2009 - found vulnerabilities.
30.09.2009 - informed owners of web sites where I found these
vulnerabilities. Taking into account, that I didn't find any contact data of
developer of TAK cms, then I hope, that owners of that site informed him
about these vulnerabilities. This is one of those cases with commercial CMS,
where developers didn't leave any contact data and there is no information
about them in Internet.
19.03.2010 - disclosed at my site.
-----------------------------
Details:

These are Insufficient Anti-automation and Brute Force vulnerabilities.

Insufficient Anti-automation:

http://site/about/contacts/ 
http://site/register/getpassword/ 

At these pages there is not protection from automated requests (captcha).

Brute Force:

http://site/auth/ 
http://site/admin/ 

In login forms there is no protection from Brute Force attacks.

Vulnerable are all versions of TAK cms.

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua 



TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH