[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
CVE-2013-1402 - DigiLIBE Management Console - Execution After Redirect (EAR) Vulnerability
Product: DigiLIBE Management Console
Version: < 3.4 - ?
Tested Version: 3.4
Vendor Notified Date: October 09, 2012
Release Date: January 18, 2013
Authentication: None required
Execution After Redirect vulnerabilities exist in DigiLIBE Management
Console versions 3.4 and possibly other versions. This allows remote
attackers to retrieve sensitive data that should only be returned to
By not properly terminating the code after redirection an
unauthenticated attacker can choose to not follow the redirect and view
the normally protected content.
Successful exploitation of this vulnerability resulted obtaining the
contents of the 'General Configuration'.
Exploit steps for proof-of-concept:
1. Using a proxy such as Burp Proxy intercept request:
2. Send to repeater.
3. View response.
Vendor Notified: Yes
Vendor Response: November 11, 2012 - Deployed security update. Version
HALOCK Security Labs