Jiros Banner Experience Pro Addadmin.ASP Authorization Bypass Vulnerability

Bugtraq ID:	17060
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Mar 09 2006 12:00AM
Updated:	Mar 11 2006 06:40AM
Credit:	Mustafa Can Bjorn is credited with the discovery of this vulnerability.
Vulnerable:	JiRos Jiros Banner Experience Pro 1.0
Not Vulnerable:

Jiros Banner Experience Pro Addadmin.ASP Authorization Bypass Vulnerability

Jiros Banner Experience Pro is prone to an authorization-bypass vulnerability. This issue is due to a failure in the application to properly perform authentication before granting access.

An attacker can exploit this vulnerability to bypass authentication and gain access as an administrative user; this may facilitate a compromise of the application.

Jiros Banner Experience Pro Addadmin.ASP Authorization Bypass Vulnerability

This issue can be exploited through a web client.

Jiros Banner Experience Pro Addadmin.ASP Authorization Bypass Vulnerability

Solution:

Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]:[email protected]

Jiros Banner Experience Pro Addadmin.ASP Authorization Bypass Vulnerability

References:

• Jiros Banner Experience Pro Web Site (Jiros)
  
• Advisory: Jiros Banner Experience Pro Remote Privilege Escalation. ([email protected])