Comdev eCommerce WCE.Download.PHP Directory Traversal Vulnerability

Bugtraq ID:	14479
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 05 2005 12:00AM
Updated:	Aug 05 2005 12:00AM
Credit:	An anonymous researcher is credited with the discovery of this vulnerability.
Vulnerable:	Comdev Comdev eCommerce 3.0
Not Vulnerable:

Comdev eCommerce WCE.Download.PHP Directory Traversal Vulnerability

Comdev eCommerce is prone to a directory traversal vulnerability.

A remote unauthorized user can disclose the contents of arbitrary local files through the use of directory traversal strings '../' relative to the Web application's root path. Exploitation of this vulnerability could lead to a loss of confidentiality.

Comdev eCommerce WCE.Download.PHP Directory Traversal Vulnerability

No exploit is required.

An example has been provided:

http://www.vulnerable.com/oneadmin/faqsupport/wce.download.php?download=../../config.php

Comdev eCommerce WCE.Download.PHP Directory Traversal Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Comdev eCommerce WCE.Download.PHP Directory Traversal Vulnerability

References:

• Comdev eCommerce Product Page (Comdev)
  
• Comdev eCommerce wce.download.php Download Vulnerability (anonymous)