Secunia

A vulnerability has been identified in BadBlue, which can be exploited by malicious people to perform arbitrary administrative actions on the server.

The vulnerability is caused due to an input validation error in the included ISAPI extension. A malicious person can exploit this to circumvent the access control to ".hts" files by appending the URL encoded representation of a space ("%20") followed by arbitrary arguments using the LoadPage command syntax to the end of the file extension of the requested file.

An example, which creates a "/root" virtual directory mapped to "\", was included in the original advisory:

http://[target]/ext.dll?MfcIsapiCommand=LoadPage&page=admin.hts%20&a0=add&a1=root&a2=%5C

BadBlue version 2.15 and prior have been reported vulnerable.

Solution
Update to version 2.16.
Further details available in Customer Area

Provided and/or discovered by
Matthew Murphy

Deep Links
Links available in Customer Area