Document Title:
===============
WampServer v3.0.6 - Insecure File Permissions


Date:
=====
2016-09-29


References:
===========
https://www.vulnerability-lab.com/get_content.php?id=1964


VL-ID:
=====
1964


Common Vulnerability Scoring System:
====================================
5.4


Introduction:
=============
WampServer (Formerly WAMP5) is a Web development platform WAMP type, for operating locally (without connecting to an external server) PHP scripts. 
WampServer is not in itself a software but an environment with two servers (Apache and MySQL), a script interpreter (PHP) and phpMyAdmin for 
administration Web MySQL databases.

(Copy of the Vendor Homepage: http://www.wampserver.com/ )


Abstract:
=========
An independent vulnerability laboratory researcher discovered an insecure file permission vulnerability in the WampServer v3.0.6 software.


Report-Timeline:
================
2016-09-30:	Public Disclosure (Vulnerability Laboratory)


Status:
========
Published


Affected Products:
==================
WAMPS
Product: WampServer - Software v3.0.6


Exploitation-Technique:
=======================
Local


Severity:
=========
Medium


Details:
========
Insecure File Permissions vulnerability has been discovered in the official WampServer v3.0.6 software.
The vulnerability exists due to insecure default permissions set on the wampmanager.exe and unins000.exe  

A local attacker could exploit this vulnerability by replacing wampmanager.exe or unins000.exe with a malicious executable file.  
The malicious file could execute or modify with the LocalSystem permissions. 


Proof of Concept:
=================
WampServer for Windows contains a vulnerability that could allow a local attacker to gain elevated privileges.
For security demonstration or to reproduce the vulnerability follow the provided information and steps below.


-- PoC Exploit --
C:wampp>icacls wampmanager.exe
wampmanager.exe BUILTINAdministrateurs:(I)(F)        <--- Full Acces
                AUTORITE NTSystème:(I)(F)
                BUILTINUtilisateurs:(I)(RX)
                AUTORITE NTUtilisateurs authentifiés:(I)(M)       <--- Modify

1 fichiers correctement traités ; échec du traitement de 0 fichiers

C:wampp>icacls unins000.exe
unins000.exe BUILTINAdministrateurs:(I)(F)       <--- Full Acces
             AUTORITE NTSystème:(I)(F)
             BUILTINUtilisateurs:(I)(RX)
             AUTORITE NTUtilisateurs authentifiés:(I)(M)       <--- Modify

1 fichiers correctement traités ; échec du traitement de 0 fichiers


Risk:
=====
The security risk of the insecure file permissions issue in the software core is estimated as medium. (CVSS 5.4)


Credits:
========
ZwX - (http://zwx.fr) [http://www.vulnerability-lab.com/show.php?user=ZwX]


Disclaimer:
===========
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either expressed 
or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable 
in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab 
or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability mainly for 
consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any licenses, policies, 
deface websites, hack into databases or trade with stolen data.

Domains:    www.vulnerability-lab.com 		- www.vuln-lab.com 						- www.evolution-sec.com
Section:    magazine.vulnerability-lab.com 	- vulnerability-lab.com/contact.php 				- evolution-sec.com/contact
Social:	    twitter.com/vuln_lab		- facebook.com/VulnerabilityLab 				- youtube.com/user/vulnerability0lab
Feeds:	    vulnerability-lab.com/rss/rss.php 	- vulnerability-lab.com/rss/rss_upcoming.php 			- vulnerability-lab.com/rss/rss_news.php
Programs:   vulnerability-lab.com/submit.php 	- vulnerability-lab.com/list-of-bug-bounty-programs.php 	- vulnerability-lab.com/register.php

Any modified copy or reproduction, including partially usages, of this file, resources or information requires authorization from Vulnerability Laboratory. 
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by 
Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website is trademark 
of vulnerability-lab team & the specific authors or managers. To record, list, modify, use or edit our material contact (admin@) to get a ask permission.

				    Copyright © 2016 | Vulnerability Laboratory - [Evolution Security GmbH]™