EZGenerator Local File Disclosure and Cross Site Request Forgery Vulnerabilities

Bugtraq ID:	64740
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 08 2014 12:00AM
Updated:	Jan 08 2014 12:00AM
Credit:	AtT4CKxT3rR0r1ST
Vulnerable:	EZGenerator EZGenerator 4.1.0.96
Not Vulnerable:

EZGenerator Local File Disclosure and Cross Site Request Forgery Vulnerabilities

EZGenerator is prone to a local file-disclosure vulnerability and a cross-site request-forgery vulnerability.

An attacker may leverage these issues to perform unauthorized actions in the context of a logged-in user, or obtain sensitive information from local files on computers running the vulnerable application. This may aid in further attacks.

EZGenerator Local File Disclosure and Cross Site Request Forgery Vulnerabilities

Attackers can exploit this issue using a browser. To exploit cross-site request-forgery issue an attacker must entice an unsuspecting victim to open a malicious URI.

The following example URI and data are available:

• /data/vulnerabilities/exploits/64740.txt

EZGenerator Local File Disclosure and Cross Site Request Forgery Vulnerabilities

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

EZGenerator Local File Disclosure and Cross Site Request Forgery Vulnerabilities

References:

• EZGenerator Homepage (EZGenerator)