PHP Upload Center Index.PHP Directory Traversal Vulnerability

Bugtraq ID:	15621
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Nov 29 2005 12:00AM
Updated:	Nov 29 2005 12:00AM
Credit:	[email protected] is credited with the discovery of this vulnerability.
Vulnerable:	PHP Upload Center PHP Upload Center
Not Vulnerable:

PHP Upload Center Index.PHP Directory Traversal Vulnerability

PHP Upload Center is prone to a directory traversal vulnerability. This is due to a lack of proper sanitization of user-supplied input.

An attacker can exploit this issue to retrieve arbitrary remote files on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access.

PHP Upload Center Index.PHP Directory Traversal Vulnerability

An exploit is not required.

Example URI have been provided:

http://www.example.com/upload/index.php?action=view&filename=../../../../../../../../../../../../../../../../etc/passwd
http://www.example.com/instaladores/index.php?action=view&filename=../../../../../../../../../../../../../../../../etc/passwd

PHP Upload Center Index.PHP Directory Traversal Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

PHP Upload Center Index.PHP Directory Traversal Vulnerability

References:

• PHPUpload Web Site (PHPUpload)