Advisory: AWBS Dedicated Server Info Visible to All Users
Release Date: 2007-06-10
Last Modified: 2007-07-26
Author: Justin Samuel [http://www.justinsamuel.com]
Application: AWBS < 2.6.0
Severity: Less Critical
Impact: Disclosure of sensitive information
Vendor Status: Vendor released version 2.6.0 to address issue. Testing still needed to verify that issue is corrected.
Vendor: Total Online Solutions, Inc.
App. Website: http://www.awbs.com/
Advanced Webhost Billing System (AWBS) allows any user access to the details of
all dedicated servers sold through AWBS.
The information made available about all dedicated servers includes:
- Server hostname
- Main IP address
- Admin username
Proof of Concept:
Proof of concept exploit code has been provided to the vendor.
2007-06-10: Informed AWBS developers of vulnerability details by email.
2007-07-26: Public disclosure.
If using AWBS to sell dedicated servers, remove the file smanage.php until the
vendor releases a fix or upgrade to patched version of software.