cPassMan v1.82 Arbitrary File Download

ID 1337DAY-ID-15857
Type zdt
Reporter Sense of Security
Modified 2011-04-16T00:00:00


Exploit for php platform in category web applications

                                            Sense of Security - Security Advisory - SOS-11-004
Release Date.                  15-Apr-2011
Last Update.                   -
Vendor Notification Date.      7-Mar-2011
Product.                       Collaborative Passwords Manager (cPassMan)
Platform.                      Independent (PHP)
Affected versions.             1.82 (verified), and possibly others
Severity Rating.               Medium
Impact.                        Local file system access
Attack Vector.                 Remote without authentication
Solution Status.               Upgrade to v2.0, v1.x branch no longer
CVE reference.                 Not yet assigned
A vulnerability has been discovered in the Collaborative Passwords Manager
(cPassMan) web application that can be exploited to retrieve files from the
local host file system. The input passed to the component
"sources/downloadfile.php" via the "path" variable allows the retrieval of
file on the local file system that the web server has access to. There is no
data validation or authorisation mechanisms present within this component.
Proof of Concept.
The author (Nils Laumaille) has indicated that the v1.x branch of cPassMan
will no longer be updated, as he has rewritten the application and v2.0 is
the recommended release.
Discovered by.
Kaan Kivilcim - Sense of Security Labs.

# [2018-03-02]  #