SlideShowPro Director 'p.php' Directory Traversal Vulnerability

Bugtraq ID:	42566
Class:	Input Validation Error
CVE:	CVE-2009-2931
Remote:	Yes
Local:	No
Published:	Aug 06 2009 12:00AM
Updated:	Aug 20 2010 09:13PM
Credit:	Scott Miles of Clear Skies Security
Vulnerable:
Not Vulnerable:

SlideShowPro Director 'p.php' Directory Traversal Vulnerability

SlideShowPro Director is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting the issue can allow an attacker to obtain sensitive information that may aid in further attacks.

SlideShowPro Director 1.1 through 1.38 are vulnerable; other versions may also be affected.

SlideShowPro Director 'p.php' Directory Traversal Vulnerability

An attacker can exploit this issue via a browser.

SlideShowPro Director 'p.php' Directory Traversal Vulnerability

Solution:
Updates are available; please see the references for more information.

SlideShowPro Director 'p.php' Directory Traversal Vulnerability

References:

• Director 1.3.9 fixes serious security issue (Dominey Designs)
  
• SlideShowPro Director Homepage (Dominey Designs)
  
• [CSS09-01] SlideShowPro Director File Disclosure Vulnerability (Scott Miles )
  
• CSS09-01: SlideShowPro Director File Disclosure Vulnerability (Clear Skies Security)