Farsinews Tiny_mce_gzip.PHP Directory Traversal Vulnerability
BID:18925
CVE-2006-3602 |Info
Farsinews Tiny_mce_gzip.PHP Directory Traversal Vulnerability
| Bugtraq ID: | 18925 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 10 2006 12:00AM |
| Updated: | Jul 21 2006 08:42PM |
| Credit: | armin390 is credited with the discovery of this vulnerability. |
| Vulnerable: |
FarsiNews FarsiNews 3.0 Beta 1 |
| Not Vulnerable: |
FarsiNews FarsiNews 3.0-Stable1 |
Discussion
Farsinews Tiny_mce_gzip.PHP Directory Traversal Vulnerability
Farsinews is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input.
An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable system in the context of the affected application. Information obtained may aid in further attacks.
Farsinews 3.0BETA1 is reported vulnerable; other versions may also be affected.
Farsinews is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input.
An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable system in the context of the affected application. Information obtained may aid in further attacks.
Farsinews 3.0BETA1 is reported vulnerable; other versions may also be affected.
Exploit / POC
Farsinews Tiny_mce_gzip.PHP Directory Traversal Vulnerability
Attackers may exploit this vulnerability via a web client.
The following exploit is available:
Attackers may exploit this vulnerability via a web client.
The following exploit is available:
Solution / Fix
Farsinews Tiny_mce_gzip.PHP Directory Traversal Vulnerability
Solution:
The vendor has released version 3.0-Stable1 to address this issue. Please refer to the vendor's home page for more information.
Solution:
The vendor has released version 3.0-Stable1 to address this issue. Please refer to the vendor's home page for more information.
References
Farsinews Tiny_mce_gzip.PHP Directory Traversal Vulnerability
References:
References:
- FarsiNews Homepage (FarsiNews)