CVE-2009-4367

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

• Sitecore Staging Module 5.4.0 - Authentication Bypass / File Manipulation2009-12-17 · webapps · windows · Verified

Impact

The Staging Webservice ("sitecore modules/staging/service/api.asmx") in Sitecore Staging Module 5.4.0 rev.080625 and earlier allows remote attackers to bypass authentication and (1) upload files, (2) download files, (3) list directories, and (4) clear the server cache via crafted SOAP requests with arbitrary Username and Password values, possibly related to a direct request.

Affected products

Weakness classification

References

• NVD record
• CVE.org record
• http://osvdb.org/61147
• http://secunia.com/advisories/37763
• http://www.exploit-db.com/exploits/10513
• http://www.securityfocus.com/archive/1/508529/100/0/threaded
• http://www.securityfocus.com/bid/37388
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54881
• https://www.sec-consult.com/files/20091217-0_sitecore_StagingModule_1.0.txt
• http://osvdb.org/61147
• http://secunia.com/advisories/37763
• http://www.exploit-db.com/exploits/10513
• http://www.securityfocus.com/archive/1/508529/100/0/threaded
• http://www.securityfocus.com/bid/37388
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54881
• https://www.sec-consult.com/files/20091217-0_sitecore_StagingModule_1.0.txt