Jorp 'functions.php' Authentication Bypass Vulnerability

Bugtraq ID:	35048
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 20 2009 12:00AM
Updated:	May 21 2009 06:40PM
Credit:	YEnH4ckEr
Vulnerable:	Whitney Powell Jorp 1.3.5 09
Not Vulnerable:

Jorp 'functions.php' Authentication Bypass Vulnerability

Jorp is prone to an authentication-bypass vulnerability because it fails to perform adequate authentication checks.

Attackers can exploit this vulnerability to gain unauthorized access to the affected application, which may aid in further attacks.

Jorp 1.3.05.09 is vulnerable; other versions may also be affected.

Jorp 'functions.php' Authentication Bypass Vulnerability

Attackers can exploit this issue via a browser.

The following example URIs are available:

http://www.example.com/[HOME_PATH]/functions.php?x=deleteProject&y=[ID]
http://www.example.com/[HOME_PATH]/functions.php?x=deleteTask&y=[ID]

Jorp 'functions.php' Authentication Bypass Vulnerability

Solution:
The vendor has submitted fixes to the application's Subversion repository. Please see the references for more information.

Jorp 'functions.php' Authentication Bypass Vulnerability

References:

• Jorp Homepage (Whitney Powell)
  
• Woo! New Blog! (Whitney Powell)
  
• (GET vars 'x' & 'y') ADMIN FUNCTION EXECUTION--Jorp v-1.3.05.09--> ([email protected])