Portix-PHP View.PHP Directory Traversal Vulnerability

Bugtraq ID:	4039
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 04 2002 12:00AM
Updated:	Feb 04 2002 12:00AM
Credit:	Discovery of this issue is credited to frog frog <[email protected]>.
Vulnerable:	Portix-PHP Portix-PHP 0.4.2 - Apache Apache 1.3.22 - Apache Apache 1.3.20 - Apache Apache 1.3.19 - Apache Apache 1.3.18 - Apache Apache 1.3.17 Portix-PHP Portix-PHP 0.4 - Apache Apache 1.3.22 - Apache Apache 1.3.20 - Apache Apache 1.3.19 - Apache Apache 1.3.18 - Apache Apache 1.3.17
Not Vulnerable:

Portix-PHP View.PHP Directory Traversal Vulnerability

Portix-PHP is freely available web portal software. It is written in PHP and will run on most Unix and Linux variants.

Portix-PHP is prone to directory traversal attacks. The script view.php does not sufficiently filter '../' sequences from web requests, making it possible for an attacker to browse the filesystem of the host running the vulnerable software. Arbitrary web-readable files may be viewed by an attacker.

Successful exploitation may cause sensitive information to be disclosed to the attacker. Information gathered in this manner may be used to aid in further attacks against the host.

Portix-PHP View.PHP Directory Traversal Vulnerability

The following example is sufficient to reproduce this issue:

www.hostportix.com/index.php?
l=forum/view.php&topic=../../../etc/passwd

Portix-PHP View.PHP Directory Traversal Vulnerability

Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Portix-PHP View.PHP Directory Traversal Vulnerability

References:

• Failles dans le portail PHP Portix (BAL Crew)
  
• Portix-PHP Homepage (Portix-PHP)