QuickPHP Directory Traversal Vulnerability
BID:45603
Info
QuickPHP Directory Traversal Vulnerability
| Bugtraq ID: | 45603 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 27 2010 12:00AM |
| Updated: | Feb 10 2011 11:49AM |
| Credit: | John Leitch |
| Vulnerable: |
QuickPHP QuickPHP 1.9.1 |
| Not Vulnerable: |
QuickPHP QuickPHP 1.10.1 |
Discussion
QuickPHP Directory Traversal Vulnerability
QuickPHP is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.
A remote attacker may leverage this issue to retrieve arbitrary files in the context of the affected application, potentially revealing sensitive information that may lead to other attacks.
QuickPHP 1.9.1 is vulnerable; other versions may also be affected.
QuickPHP is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.
A remote attacker may leverage this issue to retrieve arbitrary files in the context of the affected application, potentially revealing sensitive information that may lead to other attacks.
QuickPHP 1.9.1 is vulnerable; other versions may also be affected.
Exploit / POC
QuickPHP Directory Traversal Vulnerability
Attackers can exploit this issue through a browser.
The following exploit code is available:
Attackers can exploit this issue through a browser.
The following exploit code is available:
Solution / Fix
QuickPHP Directory Traversal Vulnerability
Solution:
Vendor update is available. Please see the references for more information.
QuickPHP QuickPHP 1.9.1
Solution:
Vendor update is available. Please see the references for more information.
QuickPHP QuickPHP 1.9.1
-
QuickPHP quickphp_webserver.zip
http://www.zachsaw.co.cc/downloads/quickphp_webserver.zip
References
QuickPHP Directory Traversal Vulnerability
References:
References:
- QuickPHP Download Page (QuickPHP)
- QuickPHP Web Server Directory Traversal Vulnerability (John Leitch)