Actu
Vigil@nce - TYPO3 pt_extbase: privilege escalation
February 2014 by Vigil@nce
This bulletin was written by Vigil@nce : http://vigilance.fr/offer
SYNTHESIS OF THE VULNERABILITY
An attacker can use the Ajax dispatcher of TYPO3 pt_extbase, in
order to access to the administration module, to escalate his
privileges.
Impacted products: TYPO3 Extensions
Severity: 2/4
Creation date: 12/02/2014
DESCRIPTION OF THE VULNERABILITY
The "Tools for Extbase development" (pt_extbase) extension is used
to create extensions. It is included in "Yet Another Gallery"
(yag).
However, the Ajax dispatcher of pt_extbase can be used by any user.
An attacker can therefore use the Ajax dispatcher of TYPO3
pt_extbase, in order to access to the administration module, to
escalate his privileges.
ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN
http://vigilance.fr/vulnerability/TYPO3-pt-extbase-privilege-escalation-14236
