Flatnuke 'level' Parameter Unauthorized Access Vulnerability

Bugtraq ID:	34486
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 13 2009 12:00AM
Updated:	Apr 15 2009 03:56PM
Credit:	Juri Gianni aka yeat
Vulnerable:	FlatNuke FlatNuke 2.7.1 FlatNuke FlatNuke 2.6.1 FlatNuke FlatNuke 2.5.8 FlatNuke FlatNuke 2.5.7 FlatNuke FlatNuke 2.5.6 FlatNuke FlatNuke 2.5.5 FlatNuke FlatNuke 2.5.4 FlatNuke FlatNuke 2.5.3 FlatNuke FlatNuke 2.5.2 FlatNuke FlatNuke 2.5.1 FlatNuke FlatNuke 2.6 FlatNuke FlatNuke 0
Not Vulnerable:

Flatnuke 'level' Parameter Unauthorized Access Vulnerability

Flatnuke is prone to an unauthorized-access vulnerability because it fails to adequately verify user-supplied input before granting administrative privileges.

An attacker can exploit this vulnerability to gain administrative control of the application; other attacks are also possible.

This issue affects Flatnuke 2.7.1; other versions may also be vulnerable.

Flatnuke 'level' Parameter Unauthorized Access Vulnerability

Attackers may exploit this issue with a browser.

The following exploit code is available:

• /data/vulnerabilities/exploits/34486.pl

Flatnuke 'level' Parameter Unauthorized Access Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Flatnuke 'level' Parameter Unauthorized Access Vulnerability

References:

• Dell KACE K1000 Systems Management Appliance Homepage (DELL)