----------------------------------------------------------------------

Bist Du interessiert an einem neuen Job in IT-Sicherheit?


Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT-
Sicherheit:
http://secunia.com/secunia_vacancies/

----------------------------------------------------------------------

TITLE:
MAXdev MD-Pro Cross-Site Scripting and File Upload Vulnerabilities

SECUNIA ADVISORY ID:
SA16731

VERIFY ADVISORY:
http://secunia.com/advisories/16731/

CRITICAL:
Moderately critical

IMPACT:
Cross Site Scripting, Exposure of system information, System access

WHERE:
>From remote

SOFTWARE:
MAXdev MD-Pro 1.x
http://secunia.com/product/5663/

DESCRIPTION:
rgod has discovered some vulnerabilities in MAXdev MD-Pro, which can
be exploited by malicious people to conduct cross-site scripting and
script insertion attacks and potentially compromise a vulnerable
system.

1) The problem is that it is possible to upload files with an
arbitrary file extension (except for files with the file extensions
".swf", ".jsp", ".php", ".php3", ".php4", ".phtml", ".pl", ".com",
".bat" and ".exe") via the "Downloads" section. This can e.g. be
exploited to upload a malicious HTML document (".html"), which will
be executed in a user's browser session in context of an affected
site when the malicious document is viewed.

2) Certain input isn't properly sanitised before being returned to
the user. This can be exploited to execute arbitrary HTML and script
code in a user's browser session in context of an affected site.

Examples:
http://[host]/modules.php?op=modload&name=subjects&file=print&print=[code]
http://[host]/modules.php?op=modload&name=Messages&file=bb_smilies&sitename=[code]
http://[host]/modules.php?op=modload&name=Messages&file=bbcode_ref&sitename=[code]
http://[host]/javascript/openwindow.php?hlpfile=")[code]

It has also been reported that it is possible to disclose the full
path to certain scripts by accessing them directly.

The vulnerabilities have been confirmed in version 1.0.73. Other
versions may also be affected.

SOLUTION:
Edit the source code to ensure that only files with trusted file
extensions can be uploaded and that input is properly sanitised.

PROVIDED AND/OR DISCOVERED BY:
rgod

ORIGINAL ADVISORY:
http://rgod.altervista.org/maxdev1073.html

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------