Secunia

frog-m@n has identified a vulnerability in multiple DUware products, allowing malicious people to gain administrative access. In DUpics it is also possible to upload arbitrary files.

In the admin area, all authentication is done in one script. It is therefore possible to bypass the authentication by accessing the individual scripts with administrative functions directly. This can be exploited to perform administrative actions.

The vulnerability has been reported to in the following software:

* DUamazon 3.0
* DUarticle 1.0
* DUcalendar 1.0, 1.1
* DUclassified 4.0, 4.1
* DUclassmate 1.0
* DUdirectory 3.0
* DUdownload 1.0
* DUfaq 1.0
* DUforum 3.0
* DUgallery 3.0, 3.1, 3.2, 3.3
* DUnews 1.0
* DUpaypal 3.0
* DUpics 3.0
* DUpoll 3.0
* DUportal 3.0

Filtering of uploaded files in DUpics is done client side using javascript. This makes it possible to easily bypass the filter by creating a fake HTML page without the javascript. This can potentially be exploited to execute arbitrary code on a vulnerable system.

Solution
The following versions are fixed according to the vendor:
Further details available in Customer Area

Provided and/or discovered by
frog-m@n

Original Advisory
http://www.security-corporation.com/advisories-026.html

Deep Links
Links available in Customer Area