PRADO 'TActiveFileUpload.php' Directory Traversal Vulnerability

Bugtraq ID:	48863
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 22 2011 12:00AM
Updated:	Jul 22 2011 12:00AM
Credit:	Gabor Berczi
Vulnerable:	PRADO PRADO 3.1.3 PRADO PRADO 3.1.2 PRADO PRADO 3.1.1 PRADO PRADO 3.1.0
Not Vulnerable:

PRADO 'TActiveFileUpload.php' Directory Traversal Vulnerability

PRADO is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue will allow an attacker to view or delete arbitrary files within the context of the webserver. Information harvested may aid in launching further attacks.

PRADO 3.1.3 and prior versions are vulnerable.

PRADO 'TActiveFileUpload.php' Directory Traversal Vulnerability

An attacker can use a Web browser to exploit this issue.

The vendor has reported that proof-of-concept code exists for this issue, but it has not been disclosed.

PRADO 'TActiveFileUpload.php' Directory Traversal Vulnerability

Solution:
The vendor has fixed the issue in the SVN repository. Please see the references for more information.

PRADO 'TActiveFileUpload.php' Directory Traversal Vulnerability

References:

• Highly critical vulnerability discovered in Prado (PRADO)
  
• Homepage (PRADO)