Help Center Live Administrator Command Execution Vulnerability
BID:13667
Info
Help Center Live Administrator Command Execution Vulnerability
| Bugtraq ID: | 13667 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | May 17 2005 12:00AM |
| Updated: | May 17 2005 12:00AM |
| Credit: | GulfTech Security Research <[email protected]> is credited with the discovery of this vulnerability. |
| Vulnerable: |
Help Center Live Help Center Live 1.2.7 Help Center Live Help Center Live 1.2.6 Help Center Live Help Center Live 1.2.5 Help Center Live Help Center Live 1.2.4 Help Center Live Help Center Live 1.2.3 Help Center Live Help Center Live 1.2.2 Help Center Live Help Center Live 1.2.1 Help Center Live Help Center Live 1.2 Help Center Live Help Center Live 1.0 |
| Not Vulnerable: | |
Discussion
Help Center Live Administrator Command Execution Vulnerability
Help Center Live is prone to an administrator command execution vulnerability. This issue is due to a failure of the application to properly validate access to administrative commands.
This issue permits a remote attacker to create a malicious URI link that performs some administrator function. If an unsuspecting forum administrator activates this URI, the attacker-supplied command would be carried out with the administrator's privileges. This occurs in the security context of the affected Web site and would cause various administrator actions to be taken.
These issues have reportedly been addressed in the latest release of Help Center Live, this information has not been confirmed by Symantec or the vendor.
Help Center Live is prone to an administrator command execution vulnerability. This issue is due to a failure of the application to properly validate access to administrative commands.
This issue permits a remote attacker to create a malicious URI link that performs some administrator function. If an unsuspecting forum administrator activates this URI, the attacker-supplied command would be carried out with the administrator's privileges. This occurs in the security context of the affected Web site and would cause various administrator actions to be taken.
These issues have reportedly been addressed in the latest release of Help Center Live, this information has not been confirmed by Symantec or the vendor.
Exploit / POC
Help Center Live Administrator Command Execution Vulnerability
No exploit is required.
No exploit is required.
Solution / Fix
Help Center Live Administrator Command Execution Vulnerability
Solution:
Reports indicate this issue has been addressed in the latest version of Help Center Live, this has not been confirmed by Symantec. Users should contact the vendor for further information.
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Reports indicate this issue has been addressed in the latest version of Help Center Live, this has not been confirmed by Symantec. Users should contact the vendor for further information.
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Help Center Live Administrator Command Execution Vulnerability
References:
References:
- Help Center Live Home Page (Help Center Live)
- Help Center Live Vulnerabilities (GulfTech Security Research