Simple File Manager Filename Script Injection Vulnerability

Bugtraq ID:	7035
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Mar 06 2003 12:00AM
Updated:	Mar 06 2003 12:00AM
Credit:	This vulnerability was disclosed by the vendor.
Vulnerable:	onedotoh sFileManager 0.19 onedotoh sFileManager 0.18 onedotoh sFileManager 0.17
Not Vulnerable:	onedotoh sFileManager 0.21

Simple File Manager Filename Script Injection Vulnerability

It has been reported that Simple File Manager fails to sufficiently sanitize user-supplied data. As it is possible for a remote user to supply data that is used within dynamically generated web pages, it may be possible to launch HTML injection attacks.

Injected HTML code may be executed in the browser of a legitimate web user who views a malicious filename. Any code executed would be in the context of the website running Simple File Manager.

Simple File Manager Filename Script Injection Vulnerability

No exploit is required.

Simple File Manager Filename Script Injection Vulnerability

Solution:
The vendor has addressed this issue in the current version of the software:


onedotoh sFileManager 0.17

• onedotoh Simple File Manager .21
  http://freshmeat.net/releases/115223/

onedotoh sFileManager 0.18

• onedotoh Simple File Manager .21
  http://freshmeat.net/releases/115223/

onedotoh sFileManager 0.19

• onedotoh Simple File Manager .21
  http://freshmeat.net/releases/115223/

Simple File Manager Filename Script Injection Vulnerability

References:

• Simple File Manager Homepage (onedotoh)