BizDesign ImageFolio Authorized User Web Root Disclosure Vulnerability
BID:4976
Info
BizDesign ImageFolio Authorized User Web Root Disclosure Vulnerability
| Bugtraq ID: | 4976 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 10 2002 12:00AM |
| Updated: | Jun 10 2002 12:00AM |
| Credit: | Published by ET LoWNOISE <[email protected]>. |
| Vulnerable: |
BizDesign ImageFolio 2.27 BizDesign ImageFolio 2.26 BizDesign ImageFolio 2.24 BizDesign ImageFolio 2.23 |
| Not Vulnerable: | |
Discussion
BizDesign ImageFolio Authorized User Web Root Disclosure Vulnerability
ImageFolio Pro is a web based image archive package, including administrative support through a web interface. A vulnerability exists in versions of ImageFolio Pro prior to 2.27.
A remote user with sufficient access to the web administration page may create a category with a maliciously constructed name. When the operation fails, an error message will be displayed which includes a full file path. This path will likely contain the web root.
An attacker may be able to use this information to launch further, intelligent attacks against the server.
ImageFolio Pro is a web based image archive package, including administrative support through a web interface. A vulnerability exists in versions of ImageFolio Pro prior to 2.27.
A remote user with sufficient access to the web administration page may create a category with a maliciously constructed name. When the operation fails, an error message will be displayed which includes a full file path. This path will likely contain the web root.
An attacker may be able to use this information to launch further, intelligent attacks against the server.
Exploit / POC
BizDesign ImageFolio Authorized User Web Root Disclosure Vulnerability
ET LoWNOISE <[email protected]> has suggested attempting to create the category "../blah" as an exploit.
ET LoWNOISE <[email protected]> has suggested attempting to create the category "../blah" as an exploit.
Solution / Fix
BizDesign ImageFolio Authorized User Web Root Disclosure Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
BizDesign ImageFolio Authorized User Web Root Disclosure Vulnerability
References:
References:
- ImageFolio Homepage (BizDesign)