YaPiG Upload.PHP Directory Traversal Vulnerability
BID:13877
Info
YaPiG Upload.PHP Directory Traversal Vulnerability
| Bugtraq ID: | 13877 |
| Class: | Input Validation Error |
| CVE: |
CVE-2005-1884 |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 06 2005 12:00AM |
| Updated: | Jul 12 2009 02:56PM |
| Credit: | This vulnerability was discovered by an anonymous person. SecWatch reported this vulnerability. |
| Vulnerable: |
YaPiG YaPig 0.94 u YaPiG YaPig 0.93 u YaPiG YaPig 0.92 b |
| Not Vulnerable: | |
Discussion
YaPiG Upload.PHP Directory Traversal Vulnerability
YaPiG is prone to a directory traversal vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.
An authorized user can add and delete arbitrary directories outside of the gallery directory by supplying directory traversal strings '../' to the vulnerable parameter. Exploitation of this vulnerability could lead to a loss of integrity and possibly loss of availability.
This issue is reported to affect YaPiG versions 0.92b, 0.93u and 0.94u; earlier versions may also be affected.
YaPiG is prone to a directory traversal vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.
An authorized user can add and delete arbitrary directories outside of the gallery directory by supplying directory traversal strings '../' to the vulnerable parameter. Exploitation of this vulnerability could lead to a loss of integrity and possibly loss of availability.
This issue is reported to affect YaPiG versions 0.92b, 0.93u and 0.94u; earlier versions may also be affected.
Exploit / POC
YaPiG Upload.PHP Directory Traversal Vulnerability
No exploit is required.
The following proof of concept URI are available:
Arbitrary Directory Removal:
http://www.example.com/upload.php?step=rmdir&dir=../folder
Arbitrary Directory Creation:
http://www.example.com/upload.php?step=mkdir&dir=../folder
No exploit is required.
The following proof of concept URI are available:
Arbitrary Directory Removal:
http://www.example.com/upload.php?step=rmdir&dir=../folder
Arbitrary Directory Creation:
http://www.example.com/upload.php?step=mkdir&dir=../folder
Solution / Fix
YaPiG Upload.PHP Directory Traversal Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
YaPiG Upload.PHP Directory Traversal Vulnerability
References:
References: