360 Web Manager 3.0 – Multiple Vulnerabilities
# Exploit Title: Multiple vulnerabilities in 360 Web Manager 3.0 # Google Dork: "Powered by 360 Web Manager 3.0" # Date: 15/04/2011 # Author: Ignacio Garrido # Contact: Ign.sec@gmail.com # Software Link: www.360webmanager.com # Version: v3.0 # Tested on: Linux *2.6.18* #Vulnerability description: 360 Web Manager 3.0 makes use of a panel manager which uses a simple file manager, this script don't require any authorization at all to upload, list, or even delete files. We can find this panel at: http:// [site]/adm/barra/assetmanager/assetmanager.php. By looking the source code we can find the internal path of the application right next to:"<input type="hidden" name="inpAssetBaseFolder0" id="inpAssetBaseFolder0" value="" Trough a forged post we can manipulate the path of the folder to list or delete: inpFileToDelete=%2FfileToDelete%2F&inpCurrFolder=%2FpathToList%2F Also when uploading a file we can easily change the path of the folder by changing the "inpCurrFolder2" parameter (there's no restriction to upload php files!). Possible solutions: *Use the admin panel session to authenticate the use of the file manager. *Forbid the upload of files with dangerous extensions such as .php,.php5, etc. *Give the appropriate permissions to read files within its own file directory. |