HandsomeWeb SOS Webpages 1.1.11 Backup / Hash Disclosure

`Vulnerability title: Unauthenticated Backup and Password Disclosure in  
HandsomeWeb SOS Webpages  
CVE: CVE-2014-3445  
Vendor: HandsomeWeb  
Product: SOS Webpages  
Affected version: 1.1.11 and earlier  
Fixed version: 1.1.12  
Reported by: Freakyclown  
  
Details:  
  
The default setup allows an unauthenticated user to access  
administrative functions such as backing up of key files within the CMS.  
This is done by appending the following to a domain using the software  
affected.  
  
/backup.php?a=2&k=6f15afa1ac4edea0g145e884116334b7  
  
Where "a" is the file number to back up and "k" is the MD5key used to  
authenticate the administrator, however if "k" does not match the  
correct key rather than disallowing the unauthenticated user to back up  
the file the service will provide the user with the correct key. For  
example:  
  
Failure, wrong key. The right key is 5f17aca1ae2edea0f145e884116371a5  
  
Using this new key in the url such as below:  
/backup.php?a=2&k=5f17aca1ae2edea0f145e884116371a5  
  
Will allow the user to perform the backup of files.  
  
In addition to this the key is generated by the code:  
$backupkey=MD5  
  
Making it trivial to decrypt the key provided above to gain the  
administrators password and gain further control over the site.  
  
  
Further details at:  
https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-3445/  
  
  
Copyright:  
Copyright (c) Portcullis Computer Security Limited 2014, All rights  
reserved worldwide. Permission is hereby granted for the electronic  
redistribution of this information. It is not to be edited or altered in  
any way without the express written consent of Portcullis Computer  
Security Limited.  
  
Disclaimer:  
The information herein contained may change without notice. Use of this  
information constitutes acceptance for use in an AS IS condition. There  
are NO warranties, implied or otherwise, with regard to this information  
or its use. Any use of this information is at the user's risk. In no  
event shall the author/distributor (Portcullis Computer Security  
Limited) be held liable for any damages whatsoever arising out of or in  
connection with the use or spread of this information.  
  
  
`