CuteFlow 'pages/edituser.php' Security Bypass Vulnerability

Bugtraq ID:	36099
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 21 2009 12:00AM
Updated:	Aug 21 2009 07:43PM
Credit:	Hever Costa Rocha
Vulnerable:	Cuteflow Bin CuteFlow 2.10.3
Not Vulnerable:

CuteFlow 'pages/edituser.php' Security Bypass Vulnerability

CuteFlow is prone to a security-bypass vulnerability because it fails to restrict access to administrative pages.

Attackers may exploit the issue to edit arbitrary user accounts, which can lead to a complete compromise of the application and may aid in further attacks.

CuteFlow 2.10.3 is vulnerable; other versions may also be affected.

CuteFlow 'pages/edituser.php' Security Bypass Vulnerability

Attackers can exploit this issue via a browser.

The following example URI is available:

http://www.example.com/cuteflow/pages/edituser.php?userid=1&language=pt&sortby=strLastName&sortdir=ASC&start=1

CuteFlow 'pages/edituser.php' Security Bypass Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

CuteFlow 'pages/edituser.php' Security Bypass Vulnerability

References:

• CuteFlow Homepage (CuteFlow)
  
• Cuteflow Version 2.10.3 "edituser.php" Security Bypass Vulnerability ([email protected])