Xrousse Beryo Downloadpic.PHP Arbitrary File Download Vulnerability

Bugtraq ID:	23387
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 09 2007 12:00AM
Updated:	Apr 10 2007 06:02PM
Credit:	GolD_M is credited with the discovery of this vulnerability.
Vulnerable:	Xrousse Beryo 2.4
Not Vulnerable:

Xrousse Beryo Downloadpic.PHP Arbitrary File Download Vulnerability

Xrousse Beryo is prone to an issue that allows an attacker to download arbitrary files.

The attacker can exploit this issue to obtain sensitive information and download arbitrary files from the webserver.

This issue affects Xrousse Beryo 2.4 and prior versions.

Xrousse Beryo Downloadpic.PHP Arbitrary File Download Vulnerability

Attackers can use a browser to exploit this issue.

Xrousse Beryo Downloadpic.PHP Arbitrary File Download Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].

Xrousse Beryo Downloadpic.PHP Arbitrary File Download Vulnerability

References:

• Xrousse Homepage (Xrousse)