webapp-exec.txt
Posted on 13 June 2007
There is a system access vulnerability in the Menu Manager Mod for WebAPP. This mod is available at http://www.2xlnt.com/webapp/development/app.cgi?action=downloadinfo&cat=webappmods&id=3 . System commands can be entered in user's personal menus. Any system command works there and allows reading of any private file or creating or deleting any file on server. Example: Entering a string in the title of an item on a user's personal menu allows them to read the WebAPP script configuration file: ";system("cat $scriptdir/conf/config.dat");" (entered WITH quotes) This exploit does not work for servers that prevent system commands from being used. The Menu Manager Mod was built in to core code of WebAPP in 2006, and the vulnerability also exists in the "WebAPP NE" script that is being distributed from web-app.net, in all known versions 0.9.9.3.3, 0.9.9.3.4, and upwards. The current WebAPP core code Menu Manager system is now secured regarding this issue in WebAPP versions 0.9.9.7 and before, from the WebAPP site at http://www.web-app.org/cgi-bin/index.cgi .
