Xoops Incontent Module Directory Traversal Vulnerability
BID:12406
Info
Xoops Incontent Module Directory Traversal Vulnerability
| Bugtraq ID: | 12406 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 28 2005 12:00AM |
| Updated: | Jan 28 2005 12:00AM |
| Credit: | Discovery is credited to Lostmon. |
| Vulnerable: |
Incontent Incontent 3.0 |
| Not Vulnerable: | |
Discussion
Xoops Incontent Module Directory Traversal Vulnerability
Xoops Incontent module is reported prone to a directory traversal vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied input.
A malicious user could issue a request containing directory traversal strings such as '../' to possibly view files outside the server root directory.
Incontent version 3.0 is reported to be susceptible to this vulnerability. Other versions may also be affected.
Xoops Incontent module is reported prone to a directory traversal vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied input.
A malicious user could issue a request containing directory traversal strings such as '../' to possibly view files outside the server root directory.
Incontent version 3.0 is reported to be susceptible to this vulnerability. Other versions may also be affected.
Exploit / POC
Xoops Incontent Module Directory Traversal Vulnerability
An exploit is not required. Examples sufficient to demonstrate this vulnerability are provided:
http://www.example.com/modules/incontent/index.php?op=aff&option=0&url=../../. ./index.php
http://www.example.com/modules/incontent/index.php?op=aff&optio n=0&url=../../../mainfile.php
An exploit is not required. Examples sufficient to demonstrate this vulnerability are provided:
http://www.example.com/modules/incontent/index.php?op=aff&option=0&url=../../. ./index.php
http://www.example.com/modules/incontent/index.php?op=aff&optio n=0&url=../../../mainfile.php
Solution / Fix
Xoops Incontent Module Directory Traversal Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Xoops Incontent Module Directory Traversal Vulnerability
References:
References:
- Incontent Module Product Page (Xoops)