LightNEasy 1.2.2 Flat Multiple Input Validation Vulnerabilities

Bugtraq ID:	28839
Class:	Input Validation Error
CVE:	CVE-2008-6590 CVE-2008-6591 CVE-2008-6589
Remote:	Yes
Local:	No
Published:	Apr 18 2008 12:00AM
Updated:	Jul 06 2016 02:17PM
Credit:	Gerendi Sandor Attila
Vulnerable:	LightNEasy LightNEasy 1.2.2 flat
Not Vulnerable:

LightNEasy 1.2.2 Flat Multiple Input Validation Vulnerabilities

LightNEasy is prone to multiple vulnerabilities, including cross-site scripting issues, arbitrary-file-creation issues, and a local file-include issue.

Successfully exploiting these issues will allow attackers to execute arbitrary code within the context of the webserver process, steal cookie-based authentication credentials, obtain sensitive information, and create arbitrary files within the context of the webserver process. Other attacks are also possible.

These issues affect LightNEasy 1.2.2 flat; other versions may also be affected.

LightNEasy 1.2.2 Flat Multiple Input Validation Vulnerabilities

Attackers can use a browser to exploit these issues. To exploit a cross-site scripting vulnerability, an attacker must entice an unsuspecting victim to follow a malicious URI.

The following proof-of-concept URI is available:

• /data/vulnerabilities/exploits/28839.html

LightNEasy 1.2.2 Flat Multiple Input Validation Vulnerabilities

Solution:
The vendor has released a patch. Please see the references for more information.

LightNEasy 1.2.2 Flat Multiple Input Validation Vulnerabilities

References:

• LightNEasy Homepage (LightNEasy)
  
• LightNEasy v.1.2.2 flat Multiple Vulnerabilities ([email protected])