Zeeways PHOTOVIDEOTUBE Multiple Remote Vulnerabilities
BID:35080
Info
Zeeways PHOTOVIDEOTUBE Multiple Remote Vulnerabilities
| Bugtraq ID: | 35080 |
| Class: | Unknown |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | May 22 2009 12:00AM |
| Updated: | May 22 2009 11:00PM |
| Credit: | Hakxer |
| Vulnerable: |
ZEEWAYS PHOTOVIDEOTUBE 1.1 |
| Not Vulnerable: | |
Discussion
Zeeways PHOTOVIDEOTUBE Multiple Remote Vulnerabilities
Zeeways PHOTOVIDEOTUBE is prone to multiple remote vulnerabilities:
- An arbitrary-file-upload vulnerability
- An authentication-bypass vulnerability
- An HTML-injection vulnerability
An attacker can exploit these issues to upload and execute arbitrary script code on an affected computer with the privileges of the webserver process, gain unauthorized access to the affected application, or execute arbitrary HTML or JavaScript code within the context of the affected site. As a result, the attacker may be able to steal cookie-based authentication credentials and control how the site is rendered to the user. Other attacks are also possible.
Zeeways PHOTOVIDEOTUBE 1.1 is vulnerable; other versions may also be affected.
Zeeways PHOTOVIDEOTUBE is prone to multiple remote vulnerabilities:
- An arbitrary-file-upload vulnerability
- An authentication-bypass vulnerability
- An HTML-injection vulnerability
An attacker can exploit these issues to upload and execute arbitrary script code on an affected computer with the privileges of the webserver process, gain unauthorized access to the affected application, or execute arbitrary HTML or JavaScript code within the context of the affected site. As a result, the attacker may be able to steal cookie-based authentication credentials and control how the site is rendered to the user. Other attacks are also possible.
Zeeways PHOTOVIDEOTUBE 1.1 is vulnerable; other versions may also be affected.
Exploit / POC
Zeeways PHOTOVIDEOTUBE Multiple Remote Vulnerabilities
Attackers may exploit these issues via a browser.
The following example data for the authentication-bypass vulnerability is available:
javascript:document.cookie="username=admin";
Attackers may exploit these issues via a browser.
The following example data for the authentication-bypass vulnerability is available:
javascript:document.cookie="username=admin";
Solution / Fix
Zeeways PHOTOVIDEOTUBE Multiple Remote Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Zeeways PHOTOVIDEOTUBE Multiple Remote Vulnerabilities
References:
References:
- PHOTOVIDEOTUBE Homepage (Zeeways)