HOMEPIMA Design 'filedown.php' Local File Disclosure Vulnerability

Bugtraq ID:	47770
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 09 2011 12:00AM
Updated:	May 09 2011 12:00AM
Credit:	KnocKout
Vulnerable:	HOMEPIMA HOMEPIMA Design 0
Not Vulnerable:

HOMEPIMA Design 'filedown.php' Local File Disclosure Vulnerability

HOMEPIMA Design is prone to a local file-disclosure vulnerability because it fails to adequately validate user-supplied input.

Exploiting this vulnerability would allow an attacker to obtain potentially sensitive information from local files on computers running the vulnerable application. This may aid in further attacks.

HOMEPIMA Design 'filedown.php' Local File Disclosure Vulnerability

Attackers may exploit this issue through a browser.

The following example URI is available:

http://www.example.com/setup/filedown.php?file=../../../../../../../../../../../../../../etc/passwd

HOMEPIMA Design 'filedown.php' Local File Disclosure Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

HOMEPIMA Design 'filedown.php' Local File Disclosure Vulnerability

References:

• Vendor Homepage (HOMEPIMA)