iManager 'crop.php' Arbitrary File Deletion Vulnerability

Bugtraq ID:	49662
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 16 2011 12:00AM
Updated:	Sep 16 2011 12:00AM
Credit:	Zero Science Lab
Vulnerable:	net4vision iManager 1.2.8
Not Vulnerable:

iManager 'crop.php' Arbitrary File Deletion Vulnerability

iManager is prone to a vulnerability that lets attackers delete arbitrary files on an affected computer in the context of the webserver.

Attackers can exploit this issue with directory-traversal strings ('../') to delete arbitrary files; this may aid in launching further attacks.

iManager 1.2.8 is vulnerable; prior versions may also be affected.

iManager 'crop.php' Arbitrary File Deletion Vulnerability

Attackers can use a browser to exploit this issue.

The following example URI is available:

http://www.example.com/jscripts/tiny_mce/plugins/imanager/scripts/phpCrop/crop.php?s=1&d=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2ftest.txt%00

iManager 'crop.php' Arbitrary File Deletion Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

iManager 'crop.php' Arbitrary File Deletion Vulnerability

References:

• iManager Plugin Homepage (net4visions)