Active Server Corner ASP Calendar Administrative Access Vulnerability

Bugtraq ID:	11931
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 14 2004 12:00AM
Updated:	Dec 14 2004 12:00AM
Credit:	Discovery is credited to ali reza AcTiOnSpIdEr <[email protected]>.
Vulnerable:	Active Server Corner ASP Calendar 1.0
Not Vulnerable:

Active Server Corner ASP Calendar Administrative Access Vulnerability

ASP Calendar is reported prone to an unauthorized administrative access vulnerability. An unauthorized remote attacker can access an administrative script and potentially gain administrative access to the application.

It is believed that this issue affects ASP Calendar Version 1.

Due to a lack of details, further information is not currently available. This BID will be updated as more information becomes available.

Active Server Corner ASP Calendar Administrative Access Vulnerability

An exploit is not required.

The following example is available:
http://www.example.com/***/admin/main.asp
*** : directory of asp calendar

Active Server Corner ASP Calendar Administrative Access Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Active Server Corner ASP Calendar Administrative Access Vulnerability

References:

• ASP Calendar Product Page (Active Server Corner)
  
• ASP Calendar Vulnerability (ali reza AcTiOnSpIdEr )