W3Mail File Disclosure Vulnerability
BID:6170
Info
W3Mail File Disclosure Vulnerability
| Bugtraq ID: | 6170 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 12 2002 12:00AM |
| Updated: | Nov 12 2002 12:00AM |
| Credit: | Discovered by Tim Brown <[email protected]>. |
| Vulnerable: |
CascadeSoft W3Mail 1.0.6 |
| Not Vulnerable: | |
Discussion
W3Mail File Disclosure Vulnerability
Versions of W3Mail 1.0.6 and greater are susceptible to a file disclosure vulnerability. To view attachments, the script "viewAttachment.cgi" accepts the parameter "file". The value of this parameter is passed to the open() function as the filename argument without being sanitized. Attackers may cause any file on the filesystem to open by specifying its relative path using directory traversal characters.
Versions of W3Mail 1.0.6 and greater are susceptible to a file disclosure vulnerability. To view attachments, the script "viewAttachment.cgi" accepts the parameter "file". The value of this parameter is passed to the open() function as the filename argument without being sanitized. Attackers may cause any file on the filesystem to open by specifying its relative path using directory traversal characters.
Exploit / POC
W3Mail File Disclosure Vulnerability
There is no exploit code required. The attacker need only issue a request with the target path, for example:
viewAttachment.cgi?file=../../../../../etc/passwd
There is no exploit code required. The attacker need only issue a request with the target path, for example:
viewAttachment.cgi?file=../../../../../etc/passwd