Web4Future Portal Solutions Arhiva.PHP Directory Traversal Vulnerability

Bugtraq ID:	15718
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 05 2005 12:00AM
Updated:	Dec 05 2005 12:00AM
Credit:	r0t is credited with the discovery of this vulnerability.
Vulnerable:	Web4Future Portal Solutions
Not Vulnerable:

Web4Future Portal Solutions Arhiva.PHP Directory Traversal Vulnerability

Portal Solutions is prone to a directory traversal vulnerability. This is due to a lack of proper sanitization of user-supplied input.

This issue may be leveraged to read arbitrary files on an affected computer with the privileges of the Web server. An attacker can employ directory traversal sequences to disclose arbitrary files.

Web4Future Portal Solutions Arhiva.PHP Directory Traversal Vulnerability

An exploit is not required.

An example URI has been provided:

http://www.example.com/arhiva.php?dir=../

Web4Future Portal Solutions Arhiva.PHP Directory Traversal Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Web4Future Portal Solutions Arhiva.PHP Directory Traversal Vulnerability

References:

• Web4Future Portal Solutions - News Portal vuln. (r0t)
  
• Web4Future Portal Solutions Web Site (Web4Future)