[IPCop-devel] [ ipcop-Bugs-3611806 ] IPCop <= 2.0.6 multiple vulnerabilities

Bugs item #3611806, was opened at 2013-04-25 01:49
Message generated for change (Tracker Item Submitted) made by yanncam
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=428516&aid=3611806&group_id=40604

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: Security (Patches etc)
Group: 2.0.0
Status: Open
Resolution: None
Priority: 5
Private: Yes
Submitted By: Yann CAM (yanncam)
Assigned to: Nobody/Anonymous (nobody)
Summary: IPCop <= 2.0.6 multiple vulnerabilities

Initial Comment:
Hello IPCop development team,

I'm contacting you to inform you of some vulnerabilities in the latest version of IPCop <= 2.0.6.

A non-persistent XSS is present and can be exploited by attackers on IE browsers.
This allows you to bypass the CSRF protection implemented (referer checking).
A Remote command execution is exploitable on all browsers (if the referer is valid).
The non-persistent XSS can be used to gain a full interactive reverse-shell with CSRF protection bypass.

You will find all details in attached PoC and a private demonstration video can be viewed here : www.youtube.com/watch?v=ovhogZGHyMg

Do not hesitate to contact me for more information.

Thanking you in advance for your work on IPCop and future potential corrections.

Sincerely,

Yann CAM - Security consultant @ Synetis - ASafety

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=428516&aid=3611806&group_id=40604