Needles to say that was scary :) anyhow I rather feel embarrassed about this one (actually I can't believe I didn't think of it myself) I've pasted his email to me below. I have not yet attempted to duplicate the bug. -- snip snip -- To replicate this bug you must have Site Administrator access to one of the accounts on the server. When you go into the Site Management for a site and select the User Management option, you get a list of the usernames that have been setup for that account. The green pencil edit icon is a command to execute the JavaScript function modify() and it passes the username as the only variable into the function. To properly execute a function from the Location Bar in Netscape, the HTML page has to be the top frame. I simply opened the userList.html file in a new frame. When you type "javascript: modify( 'admin' );" into the Location Bar, the modify() function returns a URL. The URL returned when accessing it from my site is "http://207.153.19.154:81/cgi-bin/.cobalt/siteUserMod/siteUserMod.cgi?userna me=admin&group=site151&949015199230". This loads a standard Modify User page for the "admin" account. However, when you attempt to change this information by clicking the "Confirm Modify" button, it returns a JavaScript error because the function that it calls upon is dependant on the frame layout of the Site Management page. To overcome this issue I simply downloaded two HTML files to my hard disk. One is the index.html file, other other is the right.html file. I basically changed the index.html file to call upon the URL's on my site and had it load the right.html file locally off my hard disk. I then changed the right.html file to load the URL's on my site but changed the "main" frame source to "http://207.153.19.154:81/cgi-bin/.cobalt/siteUserMod/siteUserMod.cgi?userna me=admin&group=site151&949015199230" - the Modify User page for the "admin" account. It then loads up with all the correct frames AND the Modify User page for the "admin" account. I very simply just enter a new password for the user and click "Confirm Modify" and presto! The admin password is changed allowing me access to the Server Management page showing all the server's clients, IP addresses, domain names, and ability to access all the client's contact people, telephone numbers, usernames, and passwords. I also could delete any sites/files or downloaded any sites/files. I then had full access via FTP to the site showing the root directory of the server, and the ability to delete any evidence via the /log/ directory. I hope this answers any of the questions you had, and the whole process took me under 5 minutes! -- snip snip -- the users email address is skirkhamat_private if you have any questions about it... ----->One Connection, A Million Places To Go<----- Chuck Pitre OA Group of Technologies, Internet Division Network Operations (780) 425-5151 ext 556 telephone (780) 425-3852 fax 1-888-663-1336 Toll Free
This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 15:32:03 PDT