Aprox Portal File Disclosure Vulnerability

Bugtraq ID:	9540
Class:	Access Validation Error
CVE:	CVE-2004-0237
Remote:	Yes
Local:	No
Published:	Jan 31 2004 12:00AM
Updated:	Jul 12 2009 02:06AM
Credit:	Discovery of this issue is credited to Zero_X www.lobnan.de Team <[email protected]>.
Vulnerable:	Aprox Portal Aprox Portal 3.0 Final
Not Vulnerable:

Aprox Portal File Disclosure Vulnerability

Aprox Portal is prone to a vulnerability that may permit remote attackers to gain access to files that are readable by the hosting web server. These files may exist outside of the server root.

This could expose sensitive information that may be useful in further attacks against the host.

Aprox Portal File Disclosure Vulnerability

This issue may be exploited with a web browser. The following example was provided:

http://www.example.com/index.php?show=/etc/passwd

Aprox Portal File Disclosure Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Aprox Portal File Disclosure Vulnerability

References:

• Aprox Portal Homepage (Aprox Portal)
  
• Directory Traversal in Aprox PHP Portal. (Zero_X www.lobnan.de Team )