WebTeacher WebData File Import Vulnerability
BID:1732
Info
WebTeacher WebData File Import Vulnerability
| Bugtraq ID: | 1732 |
| Class: | Access Validation Error |
| CVE: |
CVE-2000-1017 |
| Remote: | Yes |
| Local: | Yes |
| Published: | Oct 02 2000 12:00AM |
| Updated: | Jul 11 2009 03:56AM |
| Credit: | Posted to Bugtraq on October 2, 2000 by the Delphis Consulting Security Team <[email protected]>. |
| Vulnerable: |
WebTeacher WebData 2.2 |
| Not Vulnerable: | |
Discussion
WebTeacher WebData File Import Vulnerability
WebTeacher WebData is a database program deployable across the World Wide Web.
Any user who has a valid member account on WebData is capable of importing any accessible file on the system to the WebData directory. This would ensure that the user could access any file below the root directory by browsing through the database even if it has been specified that WebData would only serve up certain files. The import function should normally only allow user uploaded files into the database, however it will permit any file to be imported onto the server.
WebTeacher WebData is a database program deployable across the World Wide Web.
Any user who has a valid member account on WebData is capable of importing any accessible file on the system to the WebData directory. This would ensure that the user could access any file below the root directory by browsing through the database even if it has been specified that WebData would only serve up certain files. The import function should normally only allow user uploaded files into the database, however it will permit any file to be imported onto the server.
Solution / Fix
WebTeacher WebData File Import Vulnerability
Solution:
WebTeacher has released a new version of WebData that is not susceptible to this vulnerability. It is available for download at the following location:
http://webteacher.com/webdata/
Solution:
WebTeacher has released a new version of WebData that is not susceptible to this vulnerability. It is available for download at the following location:
http://webteacher.com/webdata/