WANGKONGBAO CNS '/src/acloglogin.php' Directory Traversal Vulnerabilities

Bugtraq ID:	54267
Class:	Input Validation Error
CVE:	CVE-2012-4031
Remote:	Yes
Local:	No
Published:	Jul 02 2012 12:00AM
Updated:	Mar 19 2015 07:35AM
Credit:	Dillon Beresford
Vulnerable:
Not Vulnerable:

WANGKONGBAO CNS '/src/acloglogin.php' Directory Traversal Vulnerabilities

WANGKONGBAO CNS 1000 and CNS 1100 are prone to multiple directory-traversal vulnerabilities because they fail to properly sanitize user-supplied input.

Remote attackers can use specially crafted requests with directory-traversal sequences ('../') to retrieve arbitrary files in the context of the application.

Exploiting these issues may allow an attacker to obtain sensitive information that could aid in further attacks.

WANGKONGBAO CNS '/src/acloglogin.php' Directory Traversal Vulnerabilities

An attacker can exploit these issues through a browser.

The following exploit is available:

• /data/vulnerabilities/exploits/54267.rb

WANGKONGBAO CNS '/src/acloglogin.php' Directory Traversal Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

WANGKONGBAO CNS '/src/acloglogin.php' Directory Traversal Vulnerabilities

References: