Lucene search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:18432
HistoryNov 17, 2007 - 12:00 a.m.

Aida-Web Information Exposure

2007-11-1700:00:00
vulners.com
31

Hi list,

Parameters being transferred per $_GET aren't sanitised properly.

http://name.tld/CGI-Bin/frame.html?Mehr=xxx

Everyone can read any comment and its poster, although it should be
readable only for superiors

http://name.tld/CGI-Bin/frame.html?Mehr=xxx&SUPER=x
You can see, which supervisor the task was forwarded to and their UniqueIDs

Anyways, everything is acting really strange if you try to test something.
Out of 10 tries, u get
8x All information you want to get
1x a weird name instead of the real one
1x a Errorpage like 404, "session timed out", blank site,…

For all these tests it is not necessary to be logged in.
There might be a lot more bugs, but I can't look for them on a live system :(

Vendor: http://www.aida-orga.de/

Regards
MC.Iglo