phpWebFileManager File Disclosure Vulnerability

Bugtraq ID:	6933
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 24 2003 12:00AM
Updated:	Feb 24 2003 12:00AM
Credit:	The vendor discovered this vulnerability.
Vulnerable:	Ondrej Jombik phpWebFileManager 0.4 Ondrej Jombik phpWebFileManager 0.3 Ondrej Jombik phpWebFileManager 0.2 Ondrej Jombik phpWebFileManager 0.1
Not Vulnerable:	Ondrej Jombik phpWebFileManager 0.5

phpWebFileManager File Disclosure Vulnerability

phpWebFileManager has been reported to be vulnerable by a file disclosure issue.

The 'file.php' script does not sufficiently validate externally supplied input and is therefore prone to a file disclosure vulnerability. It is possible for a remote attacker to submit a maliciously crafted web request, containing modified directory traversal sequences, which is capable of breaking out of wwwroot and browsing arbitrary web-readable files on a host running the vulnerable script.

Information gathered as a result of successful exploitation may aid in further attacks against the host.

phpWebFileManager File Disclosure Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

phpWebFileManager File Disclosure Vulnerability

Solution:
This issue has been fixed in the current version of the software. Users are advised to upgrade to this version.

phpWebFileManager File Disclosure Vulnerability

References:

• phpWebFileManager Home Page (Ondrej Jombík)