netOffice Dwins Authentication Bypass Vulnerability and Arbitrary File Upload Vulnerability

Bugtraq ID:	28051
Class:	Input Validation Error
CVE:	CVE-2008-2044
Remote:	Yes
Local:	No
Published:	Feb 29 2008 12:00AM
Updated:	May 07 2015 05:32PM
Credit:	dB at rawsecurity.org discovered these issues.
Vulnerable:	Luis Wang netOffice Dwins 1.3 p2
Not Vulnerable:	Luis Wang netOffice Dwins 1.3.1

netOffice Dwins Authentication Bypass Vulnerability and Arbitrary File Upload Vulnerability

netOffice Dwins is prone to a vulnerability that allows attackers to bypass authentication as well as a vulnerability that allows attackers to upload arbitrary files. These issues occur because the application fails to adequately sanitize user-supplied input.

Attackers can leverage these issues to gain unauthorized access to the application and to execute arbitrary code in the context of the application.

These issues affect Dwins 1.3 p2; other versions may also be affected.

netOffice Dwins Authentication Bypass Vulnerability and Arbitrary File Upload Vulnerability

Attackers may exploit these issues through a browser.

The following proof-of-concept code is available:

• /data/vulnerabilities/exploits/28051.html

netOffice Dwins Authentication Bypass Vulnerability and Arbitrary File Upload Vulnerability

Solution:
The vendor has released a fix. Please see the references for more information.


Luis Wang netOffice Dwins 1.3 p2

• Luis Wang netOfficeDwins1.3.1.tar.gz
  http://downloads.sourceforge.net/netofficedwins/netOfficeDwins1.3.1.ta r.gz?modtime=1208904449&big_mirror=0