SmartOptimizer Null Character Remote Information Disclosure Vulnerability

Bugtraq ID:	44578
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 01 2010 12:00AM
Updated:	Nov 01 2010 12:00AM
Credit:	Francois Harvey
Vulnerable:
Not Vulnerable:

SmartOptimizer Null Character Remote Information Disclosure Vulnerability

SmartOptimizer is prone to a remote information-disclosure vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to view the source code of files in the context of the server process; this may aid in further attacks.

SmartOptimizer 1.7 is vulnerable; prior versions may also be affected.

SmartOptimizer Null Character Remote Information Disclosure Vulnerability

Attackers can exploit this issue using a browser.

The following example URI is available:

http://www.example.com/smartoptimizer/index.php?../index.php%00.js

SmartOptimizer Null Character Remote Information Disclosure Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

SmartOptimizer Null Character Remote Information Disclosure Vulnerability

References:

• [MEDS-2010-5] SmartOptimizer NULL Injection (Francois Harvey)
  
• SmartOptimizer (Ali Farhadi)