osCommerce File Manager Directory Traversal Vulnerability

Bugtraq ID:	10364
Class:	Input Validation Error
CVE:	CVE-2004-2021
Remote:	Yes
Local:	No
Published:	May 17 2004 12:00AM
Updated:	Sep 17 2010 09:32PM
Credit:	Rene <[email protected]> originally disclosed this vulnerability to Bugtraq.
Vulnerable:	osCommerce osCommerce 2.2 ms3 osCommerce osCommerce 2.2 ms2 osCommerce osCommerce 2.2 ms1 osCommerce osCommerce 2.2 cvs osCommerce osCommerce 2.1 osCommerce osCommerce 2.2RC 2a Fastwebserver Internet Services, Inc. CartXpress 0
Not Vulnerable:

osCommerce File Manager Directory Traversal Vulnerability

osCommerce has a directory-traversal vulnerability that allows a remote attacker to possibly obtain sensitive information. The software improperly sanitizes user-supplied input and allows '../' directory-traversal character sequences when serving files.

This allows the attacker to access files outside of the application document root, potentially allowing the attacker to view files that contain sensitive information or aid them in further attacks on the computer.

osCommerce File Manager Directory Traversal Vulnerability

No exploit is required, but Rene <[email protected]> suggested that an appropriate request to exploit this vulnerability could be:

file_manager.php?action=download&filename=../../../../../../etc/passwd

An additional exploit was provided by Megasky <[email protected]>:

/admin/file_manager.php?action=read&filename=../../../../

osCommerce File Manager Directory Traversal Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

osCommerce File Manager Directory Traversal Vulnerability

References:

• osCommerce Homepage (osCommerce)
  
• Vendor Homepage (Fastwebserver Internet Services, Inc.)
  
• oscommerce 2.2 file_manager.php file browsing (Rene )
  
• osCommerce File Manager Directory Traversal Vulnerability (Megasky )