CakePHP Vendors.PHP Directory Traversal Vulnerability

Bugtraq ID:	20150
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 22 2006 12:00AM
Updated:	Sep 22 2006 08:51PM
Credit:	James Bercegay of the GulfTech Security Research Team is credited with the discovery of this vulnerability.
Vulnerable:	CakePHP CakePHP 1.1.7.3363
Not Vulnerable:	CakePHP CakePHP 1.1.8.3544

CakePHP Vendors.PHP Directory Traversal Vulnerability

CakePHP is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable system in the context of the affected application. Information obtained may aid in further attacks.

Version 1.1.7.3633 is vulnerable; earlier versions may also be affected.

CakePHP Vendors.PHP Directory Traversal Vulnerability

Attackers may exploit this vulnerability via a web client.

An example URI has been provided:

http://www.example.com/js/vendors.php?file=../../../../[file]%00foobar.js

CakePHP Vendors.PHP Directory Traversal Vulnerability

Solution:
The vendor has released version 1.1.8.3544 to address this issue; please see the references for details.


CakePHP CakePHP 1.1.7.3363

• CakePHP cake_1.1.8.3544.tar.gz
  http://cakeforge.org/frs/download.php/248/cake_1.1.8.3544.tar.gz

CakePHP Vendors.PHP Directory Traversal Vulnerability

References:

• CakePHP Downloads (CakePHP)
  
• CakePHP Homepage (CakePHP)