Promise WebPAM v2.2.0.13 Multiple Remote Vulnerabilities
Title: Promise WebPAM v2.2.0.13 Multiple Remote Vulnerabilities
Advisory ID: ZSL-2012-5077
Type: Local/Remote
Impact: Exposure of System Information, Exposure of Sensitive Information, Manipulation of Data, Cross-Site Scripting
Risk: (3/5)
Release Date: 07.03.2012
Jetty/4.2.23 (Windows XP/5.1 x86 java/1.4.2)
[2] http://cxsecurity.com/issue/WLB-2012030043
[3] http://packetstormsecurity.org/files/110557
[4] http://www.securityfocus.com/bid/52348
[5] http://xforce.iss.net/xforce/xfdb/73784
[6] http://xforce.iss.net/xforce/xfdb/73894
[7] http://osvdb.org/show/osvdb/80560
[8] http://osvdb.org/show/osvdb/80561
[9] http://osvdb.org/show/osvdb/80562
[10] http://osvdb.org/show/osvdb/80563
[08.03.2012] - Added reference [1], [2], [3] and [4]
[13.03.2012] - Added reference [5] and [6]
[27.03.2012] - Added reference [7], [8], [9] and [10]
Web: http://www.zeroscience.mk
e-mail: lab@zeroscience.mk
Advisory ID: ZSL-2012-5077
Type: Local/Remote
Impact: Exposure of System Information, Exposure of Sensitive Information, Manipulation of Data, Cross-Site Scripting
Risk: (3/5)
Release Date: 07.03.2012
Summary
WebPAM is a web based Promise Array Management Software that's easy-to use, designed to simplify RAID storage management. WebPAM is specifically designed for Promise HBA. WebPAM can configure, manage or monitor Promise RAID products remotely from a web browser from anywhere in the world.Description
Input passed via the parameters 'entSortOrder' and 'entSort' in 'ent_i.jsp' script are not properly sanitised before being returned to the user or used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. The parameters 'startTime' and 'endTime' in 'ent_i.jsp' are vulnerable to a XSS issue where the attacker can execute arbitrary HTML and script code in a user's browser session in context of an affected site. The parameter 'userID' in 'usr_ent.jsp' and 'usr_t.jsp' is vulnerable to HTTP Response Splitting which can be exploited to insert arbitrary HTTP headers, which are included in a response sent to the user.Vendor
Promise Technology, Inc. - http://www.promise.comAffected Version
2.2.0.13Tested On
Microsoft Windows XP Professional SP3 (EN)Jetty/4.2.23 (Windows XP/5.1 x86 java/1.4.2)
Vendor Status
N/APoC
webpam_mv.txtCredits
Vulnerability discovered by Gjoko Krstic - <gjoko@zeroscience.mk>References
[1] http://www.exploit-db.com/exploits/18571/[2] http://cxsecurity.com/issue/WLB-2012030043
[3] http://packetstormsecurity.org/files/110557
[4] http://www.securityfocus.com/bid/52348
[5] http://xforce.iss.net/xforce/xfdb/73784
[6] http://xforce.iss.net/xforce/xfdb/73894
[7] http://osvdb.org/show/osvdb/80560
[8] http://osvdb.org/show/osvdb/80561
[9] http://osvdb.org/show/osvdb/80562
[10] http://osvdb.org/show/osvdb/80563
Changelog
[07.03.2012] - Initial release[08.03.2012] - Added reference [1], [2], [3] and [4]
[13.03.2012] - Added reference [5] and [6]
[27.03.2012] - Added reference [7], [8], [9] and [10]
Contact
Zero Science LabWeb: http://www.zeroscience.mk
e-mail: lab@zeroscience.mk
