|
Description
|
|
High-Tech Bridge SA has discovered multiple vulnerabilities in 11in1, which can be exploited by malicious people to conduct cross-site request forgery attacks and disclose sensitive information.
1) The application's web interface allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to e.g. change an administrator's password by tricking a logged in administrator into visiting a malicious web site.
2) Input passed via the "class" parameter to index.php and admin/index.php is not properly verified before being used to include files. This can be exploited to include arbitrary files from local resources via directory traversal attacks and URL-encoded NULL bytes.
Successful exploitation of this vulnerability requires that "magic_quotes_gpc" is disabled.
The vulnerabilities are confirmed in version 1.2.1. Other versions may also be affected.
|
|
|
|
|
|
Vulnerable Products
|
|
Vulnerable Software:
11in1 1.x
|
|
|
|
|
|
Solution
|
|
Edit the source code to ensure that input is properly verified. Do not browse untrusted websites or follow untrusted links while logged in to the application.
|
|
|
|
|
|
CVE
|
|
CVE-2012-0997
CVE-2012-0996
|
|
|
|
|
|
References
|
|
HTB23071:
https://www.htbridge.ch/advisory/HTB23071
|
|
|
|
|
|
Vulnerability Manager Detection
|
|
No
|
|
|
|
|
|
IPS Protection
|
|
|
|
|
|
|
