eLouai's Force Download Script 'force-download.php' Arbitrary File Download Vulnerability

Bugtraq ID:	44621
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 03 2010 12:00AM
Updated:	Nov 03 2010 12:00AM
Credit:	v1R00Z
Vulnerable:	iNET Interactive eLouai's Force Download Script 0
Not Vulnerable:

eLouai's Force Download Script 'force-download.php' Arbitrary File Download Vulnerability

eLouai's Force Download Script is prone to a vulnerability that lets attackers download arbitrary files. The issue occurs because the application fails to sufficiently sanitize user-supplied input.

Exploiting this issue will allow an attacker to view arbitrary files within the context of the application. Information harvested may aid in launching further attacks.

eLouai's Force Download Script 'force-download.php' Arbitrary File Download Vulnerability

An attacker can exploit this issue via a browser.

The following example URI is available:

http://www.example.com/force-download.php?file=../../../../etc/passwd

eLouai's Force Download Script 'force-download.php' Arbitrary File Download Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

eLouai's Force Download Script 'force-download.php' Arbitrary File Download Vulnerability

References:

• eLouai's Force Download Script Homepage (iNET Interactive)