Eschew.Net PHPBannerExchange ResetPW.PHP Directory Traversal Vulnerability

Bugtraq ID:	16996
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Mar 07 2006 12:00AM
Updated:	Jun 09 2006 03:56PM
Credit:	TiX of h4cky0u Security Forums is credited with the discovery of this vulnerability.
Vulnerable:	eschew.net phpBannerExchange 2.0
Not Vulnerable:

Eschew.Net PHPBannerExchange ResetPW.PHP Directory Traversal Vulnerability

phpBannerExchange is prone to a directory-traversal vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable system in the context of the webserver process. Information obtained may aid in further attacks.

This issue affects phpBannerExchange versions 2.0 and earlier.

Eschew.Net PHPBannerExchange ResetPW.PHP Directory Traversal Vulnerability

This issue can be exploited through a web client.

Eschew.Net PHPBannerExchange ResetPW.PHP Directory Traversal Vulnerability

Solution:
The vendor has released a patch to address this issue.


eschew.net phpBannerExchange 2.0

• eschew.net resetpw.txt
  http://www.eschew.net/scripts/phpbe/2.0/resetpw.txt

Eschew.Net PHPBannerExchange ResetPW.PHP Directory Traversal Vulnerability

References:

• HYSA-2006-004 - phpBannerExchange 2.0 Directory Traversal Vulnerability (h4cky0u.org)
  
• IMPORTANT: Security update for phpBannerExchange 2.0 (Darkrose)
  
• phpBannerExchange Homepage (eschew.net)
  
• phpBannerExchange 2.0 Directory Traversal Vulnerability ([email protected])