TorrentTrader Multiple Security Vulnerabilities
BID:55584
Info
TorrentTrader Multiple Security Vulnerabilities
| Bugtraq ID: | 55584 |
| Class: | Unknown |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 17 2012 12:00AM |
| Updated: | Sep 17 2012 12:00AM |
| Credit: | Janek Vind "waraxe" |
| Vulnerable: |
TorrentTrader TorrentTrader 2.08 |
| Not Vulnerable: | |
Discussion
TorrentTrader Multiple Security Vulnerabilities
TorrentTrader is prone to multiple security vulnerabilities including:
1. Multiple security-bypass vulnerabilities
2. An arbitrary file-creation vulnerability
3. Multiple cross-site scripting vulnerabilities
4. Multiple path-disclosure vulnerabilities
An attacker may leverage these issues to obtain potentially sensitive information and to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, to create or write arbitrary files in context of the affected application, bypass certain security restrictions, or perform some unauthorized actions. Other attacks are also possible.
TorrentTrader 2.08 is vulnerable; other versions may also be affected.
TorrentTrader is prone to multiple security vulnerabilities including:
1. Multiple security-bypass vulnerabilities
2. An arbitrary file-creation vulnerability
3. Multiple cross-site scripting vulnerabilities
4. Multiple path-disclosure vulnerabilities
An attacker may leverage these issues to obtain potentially sensitive information and to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, to create or write arbitrary files in context of the affected application, bypass certain security restrictions, or perform some unauthorized actions. Other attacks are also possible.
TorrentTrader 2.08 is vulnerable; other versions may also be affected.
References
TorrentTrader Multiple Security Vulnerabilities
References:
References:
- TorrentTrader Homepage (TorrentTrader)
- TorrentTrader Project Page (TorrentTrader)
- [waraxe-2012-SA#089] - Multiple Vulnerabilities in TorrentTrader 2.08 (Janek Vind "waraxe")