Text Lines Rearrange Script 'download.php' Information Disclosure Vulnerability

Bugtraq ID:	32968
Class:	Design Error
CVE:	CVE-2008-6336
Remote:	Yes
Local:	No
Published:	Dec 22 2008 12:00AM
Updated:	Apr 13 2015 09:12PM
Credit:	SirGod
Vulnerable:	Rightscripts Text Lines Rearrange Script 0
Not Vulnerable:

Text Lines Rearrange Script 'download.php' Information Disclosure Vulnerability

Text Lines Rearrange Script is prone to an information-disclosure vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to view arbitrary files in the context of the webserver process. This may aid in further attacks.

Text Lines Rearrange Script 'download.php' Information Disclosure Vulnerability

Attackers can exploit this issue via a browser.

The following example URI is available:

http://www.example.com/[path]/download.php?filename=index.php

Text Lines Rearrange Script 'download.php' Information Disclosure Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Text Lines Rearrange Script 'download.php' Information Disclosure Vulnerability

References:

• Rightscripts Homepage (Rightscripts)