Easy File Sharing Web Server 'thumbnail.php' File Disclosure Vulnerability

Bugtraq ID:	33973
Class:	Input Validation Error
CVE:	CVE-2009-4809
Remote:	Yes
Local:	No
Published:	Mar 04 2009 12:00AM
Updated:	Apr 13 2015 09:11PM
Credit:	Mountassif Moad
Vulnerable:	Efssoft Easy File Sharing Web Server 4.8
Not Vulnerable:

Easy File Sharing Web Server 'thumbnail.php' File Disclosure Vulnerability

Easy File Sharing Web Server is prone to a vulnerability that lets attackers obtain potentially sensitive information because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to download arbitrary files with the privileges of the webserver process. Information obtained may aid in further attacks.

Easy File Sharing Web Server 4.8 is vulnerable; other versions may also be affected.

Easy File Sharing Web Server 'thumbnail.php' File Disclosure Vulnerability

Attackers can use a browser to exploit this issue.

The following example URI is available:

http://www.example.com/disk_c/thumbnail.ghp?vfolder=../../.././/./../../boot.ini

Easy File Sharing Web Server 'thumbnail.php' File Disclosure Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Easy File Sharing Web Server 'thumbnail.php' File Disclosure Vulnerability

References:

• Easy File Sharing Web Server Homepage (EFS Software Inc.)