Libra File Manager 'fileadmin.php' Local File Include Vulnerability

Bugtraq ID:	31403
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 25 2008 12:00AM
Updated:	Mar 06 2009 03:06AM
Credit:	Pepelux
Vulnerable:	Devin Smith Libra File Manager 2.0 Devin Smith Libra File Manager 1.18
Not Vulnerable:

Libra File Manager 'fileadmin.php' Local File Include Vulnerability

Libra File Manager is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability using directory-traversal strings to view local files within the context of the webserver process. Information harvested may aid in further attacks.

Libra File Manager 2.0 and prior versions are available.

Libra File Manager 'fileadmin.php' Local File Include Vulnerability

Attackers can exploit this issue via a browser.

The following exploit is available:

• /data/vulnerabilities/exploits/31403.pl

Libra File Manager 'fileadmin.php' Local File Include Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Libra File Manager 'fileadmin.php' Local File Include Vulnerability

References:

• Libra File Manager Homepage (Devin Smith)
  
• Fwd: Returned post for [email protected] ("Jose Luis" )