DMXReady Contact Us Manager

vendor:

by:

ajann

7.5

CVSS

HIGH

Remote Contents Change Vulnerability

284

CWE

Product Name: Contact Us Manager

Affected Version From: 1.1

Affected Version To: 1.1

Patch Exists: NO

Related CWE: N/A

CPE: a:dmxready:contact_us_manager

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

DMXReady Contact Us Manager <= 1.1 Remote Contents Change Vulnerability

A vulnerability in DMXReady Contact Us Manager version 1.1 allows an attacker to remotely change the contents of the application. This is due to the lack of authentication when accessing the add_category.asp page, which allows an attacker to insert, update, and delete categories and subcategories, as well as upload images.

Mitigation:

Ensure that authentication is required for all pages that allow for content changes.

Source

Exploit-DB raw data:

*******************************************************************************
# Title   :  DMXReady Contact Us Manager <= 1.1 Remote Contents Change Vulnerability
# Author  :  "ajann" from Turkey
# Contact :   :( 
# S.Page  :  http://www.dmxready.com
# $$      :  49.97 $
# Dork    :  inurl:inc_contactusmanager.asp
# DorkEx  :
http://www.google.com.tr/search?hl=tr&q=inurl%3Ainc_contactusmanager.asp&meta=

****Stop Attack ABD and ISRAEL !


*******************************************************************************

Permissions:
Update
Delete
Insert Category / Sub Category
Image Upload

# http://[target]/[path]/admin/ContactUsManager/add_category.asp

Example: 
You Find -> http://[target]/[path]//applications/ContactUsManager/inc_contactusmanager.asp
Edit  ->    http://[target]/[path]//admin/ContactUsManager/add_category.asp

 :)

# milw0rm.com [2009-01-14]