OpenWGA Developer Studio 3.1.0 OpenDialog Arbitrary Code Execution


Vendor: Innovation Gate GmbH
Product web page: https://www.openwga.com
Affected version: 3.1.0.r00147

Summary: The OpenWGA Developer Studio packages an OpenWGA CMS server
together with all necessary development and deployment tools to create,
develop, deploy, share and maintain your OpenWGA CMS applications.

Desc: The application suffers from an arbitrary code execution vulnerability
when using the File OpenDialog box enabling the attacker to execute any
binary he or she chooses including elevation of privileges.

Tested on: Microsoft Windows 7 Professional SP1 (EN)
           Microsoft Windows 7 Ultimate SP1 (EN)
           Java/1.8.0.77-b03


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2016-5317
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5317.php


23.02.2016

--


From the menu:

File > Open > "c:\windows\system32\calc.exe"