Horizon QCMS 'fopen()' Function Directory Traversal Vulnerability

Bugtraq ID:	64717
Class:	Input Validation Error
CVE:	CVE-2013-7138
Remote:	Yes
Local:	No
Published:	Jan 08 2014 12:00AM
Updated:	Jan 08 2014 12:00AM
Credit:	High-Tech Bridge Security Research Lab
Vulnerable:
Not Vulnerable:

Horizon QCMS 'fopen()' Function Directory Traversal Vulnerability

Horizon QCMS is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input.

A remote attacker could exploit the vulnerability using directory-traversal characters ('../') to access arbitrary files that contain sensitive information. Information harvested may aid in launching further attacks.

Horizon QCMS 4.0 and prior are vulnerable.

Horizon QCMS 'fopen()' Function Directory Traversal Vulnerability

An attacker can use a browser to exploit this issue.

The following example URI is available:

http://www.example.com/lib/functions/d-load.php?start=../../config.php

Horizon QCMS 'fopen()' Function Directory Traversal Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Horizon QCMS 'fopen()' Function Directory Traversal Vulnerability

References: