MochaSoft FtpDisc Directory Traversal Vulnerability
BID:46500
Info
MochaSoft FtpDisc Directory Traversal Vulnerability
| Bugtraq ID: | 46500 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 22 2011 12:00AM |
| Updated: | Feb 22 2011 12:00AM |
| Credit: | R3d@l3rt, Sp@2K, Sunlight |
| Vulnerable: |
MochaSoft FtpDisc 1.0 |
| Not Vulnerable: | |
Discussion
MochaSoft FtpDisc Directory Traversal Vulnerability
MochaSoft FtpDisc is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.
Exploiting this issue can allow an attacker to retrieve arbitrary files outside of the FTP server root directory. This may aid in further attacks.
MochaSoft FtpDisc 1.0 is affected; other versions may also be vulnerable.
MochaSoft FtpDisc is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.
Exploiting this issue can allow an attacker to retrieve arbitrary files outside of the FTP server root directory. This may aid in further attacks.
MochaSoft FtpDisc 1.0 is affected; other versions may also be vulnerable.
Exploit / POC
MochaSoft FtpDisc Directory Traversal Vulnerability
Attackers can exploit this issue through a browser.
The following example request is available:
GET /../../../../../../etc/passwd
Attackers can exploit this issue through a browser.
The following example request is available:
GET /../../../../../../etc/passwd
Solution / Fix
MochaSoft FtpDisc Directory Traversal Vulnerability
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].