Menu Manager Mod for WebAPP - No Input Filtering
There is a system access vulnerability in the Menu Manager Mod for WebAPP. This
mod is available at
http://www.2xlnt.com/webapp/development/app.cgi?action=downloadinfo&cat=webappmods&id=3
.
System commands can be entered in user's personal menus. Any system command
works there and allows reading of any private file or creating or deleting any
file on server.
Example: Entering a string in the title of an item on a user's personal menu
allows them to read the WebAPP script configuration file:
";system("cat $scriptdir/conf/config.dat");"
(entered WITH quotes)
This exploit does not work for servers that prevent system commands from being
used.
The Menu Manager Mod was built in to core code of WebAPP in 2006, and the
vulnerability also exists in the "WebAPP NE" script that is being distributed
from web-app.net, in all known versions 0.9.9.3.3, 0.9.9.3.4, and upwards.
The current WebAPP core code Menu Manager system is now secured regarding this
issue in WebAPP versions 0.9.9.7 and before, from the WebAPP site at
http://www.web-app.org/cgi-bin/index.cgi .