Multiple vulnerabilities in 360 Web Manager 3.0

vendor:

360 Web Manager 3.0

by:

Ignacio Garrido

8.8

CVSS

HIGH

File Upload Vulnerability

434

CWE

Product Name: 360 Web Manager 3.0

Affected Version From: 3

Affected Version To: 3

Patch Exists: NO

Related CWE: N/A

CPE: 360webmanager.com

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Linux *2.6.18*

2011

Multiple vulnerabilities in 360 Web Manager 3.0

360 Web Manager 3.0 makes use of a panel manager which uses a simple file manager, this script don't require any authorization at all to upload, list, or even delete files. By looking the source code we can find the internal path of the application right next to: 'inpAssetBaseFolder0'. Through a forged post we can manipulate the path of the folder to list or delete. Also when uploading a file we can easily change the path of the folder by changing the 'inpCurrFolder2' parameter (there's no restriction to upload php files!).

Mitigation:

Use the admin panel session to authenticate the use of the file manager. Forbid the upload of files with dangerous extensions such as .php,.php5, etc. Give the appropriate permissions to read files within its own file directory.

Source

Exploit-DB raw data:

# Exploit Title: Multiple vulnerabilities in 360 Web Manager 3.0
# Google Dork: "Powered by 360 Web Manager 3.0"
# Date: 15/04/2011
# Author: Ignacio Garrido
# Contact: Ign.sec@gmail.com
# Software Link: www.360webmanager.com
# Version: v3.0
# Tested on: Linux *2.6.18*

#Vulnerability description:

360 Web Manager 3.0 makes use of a panel manager which uses a simple file
manager, this script don't require any authorization at all to upload, list,
or even delete files.

We can find this panel at: http://
[site]/adm/barra/assetmanager/assetmanager.php.

By looking the source code we can find the internal path of the application
right next to:"<input type="hidden" name="inpAssetBaseFolder0"
id="inpAssetBaseFolder0"
value=""

Trough a forged post we can manipulate the path of the folder to list or
delete: inpFileToDelete=%2FfileToDelete%2F&inpCurrFolder=%2FpathToList%2F

Also when uploading a file we can easily change the path of the folder by
changing the "inpCurrFolder2" parameter (there's no restriction to upload
php files!).


Possible solutions:

*Use the admin panel session to authenticate the use of the file manager.

*Forbid the upload of files with dangerous extensions such as .php,.php5,
etc.

*Give the appropriate permissions to read files within its own file
directory.