Security Flaw (Image/Filemanager)

Priority: 5 Status: Closed Resolution: Yes

Description:

I've found some critical bugs into /js/editor/plugins/jakadminexplorer (also jakadminimage, jakusrexplorer and jakusrimage are vulnerable).

The authentication schema could be bypassed into /php/session.php, this is the vulnerable code:

if ($SESSION["check_session_variable"] != "") {

// Session Starten

session_start();

// Session-Variable überprüfen

if (!isset($_SESSION[$SESSION["check_session_variable"]])) {

include("error.php");

die;

}

}

An attacker might be able to start a session accessing to /index.php that set for e.g. the "jak_lastURL" session variable, than could set $SESSION["check_session_variable"] to bypass this trivial auth schema.

In this way an unauthenticated user have access to "Explorer" and "Image Manager" plugins and could be "delete", "create", "rename" any folder/file into webserver or upload arbitray files.