Siteframe Download.php Information Disclosure Vulnerability

Bugtraq ID:	7143
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Mar 19 2003 12:00AM
Updated:	Mar 19 2003 12:00AM
Credit:	Discovery of this vulnerability has been credited to Ertan Kurt <[email protected]>.
Vulnerable:	Siteframe Siteframe 2.2.4
Not Vulnerable:

Siteframe Download.php Information Disclosure Vulnerability

Siteframe has been reported vulnerable to an information disclosure vulnerability.

When handling certain download requests Siteframe may be lead into an error condition. When these errors occur, the script will output some path information.

Information obtained in this manner may be used by an attacker to launch further attacks against a vulnerable system.

Siteframe Download.php Information Disclosure Vulnerability

The following proof of concept was provided:

http://www.example.com/download.php?id=2%

Siteframe Download.php Information Disclosure Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Siteframe Download.php Information Disclosure Vulnerability

References:

• Siteframe Homepage (Siteframe)
  
• Some XSS vulns (Ertan Kurt )