phpWebFileManager index.php Directory Traversal Vulnerability
BID:9053
Info
phpWebFileManager index.php Directory Traversal Vulnerability
| Bugtraq ID: | 9053 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 17 2003 12:00AM |
| Updated: | Nov 17 2003 12:00AM |
| Credit: | The disclosure of this issue has been credited to RusH security team <www.rsteam.ru>. |
| Vulnerable: |
Ondrej Jombik phpWebFileManager 2.0 |
| Not Vulnerable: | |
Discussion
phpWebFileManager index.php Directory Traversal Vulnerability
It has been reported that phpWebFileManager may be prone to a directory traversal vulnerability that may allow an attacker to gain access to sensitive information. The issue presents itself due to insufficient sanitization of user-supplied input. An attacker may traverse outside the server root directory by using '../' character sequences.
phpWebFileManager version 2.0.0 is reported to be prone to this issue, however other versions may be affected as well.
It has been reported that phpWebFileManager may be prone to a directory traversal vulnerability that may allow an attacker to gain access to sensitive information. The issue presents itself due to insufficient sanitization of user-supplied input. An attacker may traverse outside the server root directory by using '../' character sequences.
phpWebFileManager version 2.0.0 is reported to be prone to this issue, however other versions may be affected as well.
Exploit / POC
phpWebFileManager index.php Directory Traversal Vulnerability
The following proof of concept has been provided:
http://www.example.com/phpwebfilemgr/index.php?f=../../../
The following proof of concept has been provided:
http://www.example.com/phpwebfilemgr/index.php?f=../../../
Solution / Fix
References
phpWebFileManager index.php Directory Traversal Vulnerability
References:
References: