← Advisories

up.time 7.5.0 Superadmin Privilege Escalation Exploit

High

Advisory ID

ZSL-2015-5251

Release Date

19 August 2015

Vendor

Idera Inc. - http://www.uptimesoftware.com

Affected Version

7.5.0 (build 16) and 7.4.0 (build 13)

CVE

N/A

Tested On

Jetty, PHP/5.4.34, MySQL, Apache/2.2.29 (Win64) mod_ssl/2.2.29 OpenSSL/1.0.1j PHP/5.4.34

Summary

The next-generation of IT monitoring software.

Description

up.time suffers from a privilege escalation issue. Normal user can elevate his/her privileges by sending a POST request seting the parameter 'userroleid' to 1. Attacker can exploit this issue using also cross-site request forgery attacks.

Proof of Concept

uptime_pe.txtTXT

Disclosure Timeline

29.07.2015Vulnerability discovered.

06.08.2015Vendor contacted.

18.08.2015No response from the vendor.

19.08.2015Public security advisory released.

Credits

Vulnerability discovered by Gjoko Krstic

References

[1]https://www.zeroscience.mk/#/advisories/ZSL-2015-5254

[2]http://cxsecurity.com/issue/WLB-2015080120

[3]https://www.exploit-db.com/exploits/37885/

[4]https://packetstormsecurity.com/files/133252

[5]https://exchange.xforce.ibmcloud.com/vulnerabilities/105836

Changelog

19.08.2015Initial release

13.09.2015Added reference [2], [3], [4] and [5]