Social Site Generator Multiple Information Disclosure Vulnerabilities

Bugtraq ID:	34149
Class:	Design Error
CVE:	CVE-2008-6420
Remote:	Yes
Local:	No
Published:	Jun 01 2008 12:00AM
Updated:	Mar 17 2009 10:26PM
Credit:	Stack & Jadi
Vulnerable:	Social Site Generator Social Site Generator 0
Not Vulnerable:

Social Site Generator Multiple Information Disclosure Vulnerabilities

Social Site Generator is prone to multiple information-disclosure vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker can exploit these vulnerabilities to view arbitrary files in the context of the webserver process. This may aid in further attacks.

Social Site Generator Multiple Information Disclosure Vulnerabilities

Attackers can exploit these issues via a browser.

The following example URIs are available:

http://www.example.com/path/filedload.php?file=filedload.php
http://www.example.com/path/webadmin/download.php?file=download.php
http://www.example.com/path/webadmin/download_file.php

Social Site Generator Multiple Information Disclosure Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Social Site Generator Multiple Information Disclosure Vulnerabilities

References:

• Social Site Generator Homepage (Social Site Generator)