XennoBB Profile.PHP Directory Traversal Vulnerability

Bugtraq ID:	19446
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 09 2006 12:00AM
Updated:	Aug 25 2006 04:59PM
Credit:	Chris Boulton is credited with the discovery of this vulnerability.
Vulnerable:	XennoBB XennoBB 2.2.1 XennoBB XennoBB 2.2 XennoBB XennoBB 2.1 XennoBB XennoBB 1.0.6 XennoBB XennoBB 1.0.5
Not Vulnerable:

XennoBB Profile.PHP Directory Traversal Vulnerability

XennoBB is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable system in the context of the affected application. Information obtained may aid in further attacks.

XennoBB 2.1.0 and earlier are vulnerable to this issue; other versions may also be affected.

XennoBB Profile.PHP Directory Traversal Vulnerability

Attackers may exploit this vulnerability via a web client.

The following proof of concept is available:

• /data/vulnerabilities/exploits/XennoBBDirectoryTraversalAugust082006.html

XennoBB Profile.PHP Directory Traversal Vulnerability

Solution:
The vendor has released version 2.2.2 to address this issue. Please see the references for more information.

XennoBB Profile.PHP Directory Traversal Vulnerability

References:

• Security Alert: Viewfile script allows view of arbitrary files (CVE-2006-4294) (Twiki)
  
• Twiki Home Page (Twiki)