[KAPDA::#46] - Nukedit Unauthorized Admin Add

KAPDA New advisory

Vulnerable product : Nukedit <= 4.9.6

Vendor: http://www.nukedit.com

Vulnerability: Unauthorized Admin Add

Date :

--------------------

Found : 2006/05/10

Vendor Contacted : N/A

Release Date : 2006/05/29

About Nukedit :

--------------------

Nukedit is a Content Management System (CMS).

Vulnerable page:

--------------------

utilities/register.asp

PoC:

--------------------

HTML PoC : http://kapda.ir/attach-1661-nukedit.txt

Save this code as .htm and then execute.

This exploit will create an admin acount .

Then login with your email ! + your password .

Solution:

--------------------

Update to new version of nukedit .

Original Advisory:

--------------------

http://www.kapda.ir/advisory-337.html

Credit :

--------------------

FarhadKey of KAPDA

farhadkey [at} kapda <d0t> net

Kapda - Security Science Researchers Insitute of Iran

http://www.KAPDA.ir

[ reply ]