phpNewsManager Functions Script File Disclosure Vulnerability
BID:9720
Info
phpNewsManager Functions Script File Disclosure Vulnerability
| Bugtraq ID: | 9720 |
| Class: | Access Validation Error |
| CVE: |
CVE-2004-0327 |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 23 2004 12:00AM |
| Updated: | Jul 12 2009 03:06AM |
| Credit: | Discovery is credited to G00db0y. |
| Vulnerable: |
SkinTech phpNewsManager 1.36 |
| Not Vulnerable: | |
Discussion
phpNewsManager Functions Script File Disclosure Vulnerability
phpNewsManager is prone to a file disclosure vulnerability. Remote attackers may submit malicious requests to the software that contain directory traversal sequences, potentially exposing sensitive resources outside of the hosting web server root.
phpNewsManager is prone to a file disclosure vulnerability. Remote attackers may submit malicious requests to the software that contain directory traversal sequences, potentially exposing sensitive resources outside of the hosting web server root.
Exploit / POC
phpNewsManager Functions Script File Disclosure Vulnerability
This issue may be exploited with a web browser. The following example was provided:
http://www.example.com/functions.php?clang=../../../[existing_file]
This issue may be exploited with a web browser. The following example was provided:
http://www.example.com/functions.php?clang=../../../[existing_file]
Solution / Fix
phpNewsManager Functions Script File Disclosure Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
phpNewsManager Functions Script File Disclosure Vulnerability
References:
References: