Summaryinfo

A vulnerability described as critical has been identified in Qiwen Zhang Briefcase for iOS 4.0. This affects an unknown function of the component Upload Handler. The manipulation of the argument filename results in privileges management. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability, which was classified as critical, was found in Qiwen Zhang Briefcase for iOS 4.0 (iOS App Software). Affected is an unknown code block of the component Upload Handler. The manipulation of the argument filename with an unknown input leads to a privileges management vulnerability. CWE is classifying the issue as CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. This is going to have an impact on confidentiality, integrity, and availability.

The weakness was presented 09/15/2014 as not defined posting (Bugtraq). The advisory is shared for download at archives.neohapsis.com. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1068.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at X-Force (95982). See VDB-67547 for similar entry. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• iOS App Software

Vendor

• Qiwen Zhang

Name

• Briefcase for iOS

Version

• 4.0

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion