eXtplorer CVE-2016-4313 Local Directory Traversal Vulnerability

Bugtraq ID:	98069
Class:	Input Validation Error
CVE:	CVE-2016-4313
Remote:	No
Local:	Yes
Published:	Apr 24 2017 12:00AM
Updated:	May 02 2017 12:11AM
Credit:	John Page aka hyp3rlinx.
Vulnerable:	eXtplorer eXtplorer 2.1.9
Not Vulnerable:

eXtplorer CVE-2016-4313 Local Directory Traversal Vulnerability

eXtplorer is prone to a local directory-traversal vulnerability because the application fails to sufficiently sanitize user-supplied input.

An attacker can exploit this issue using directory-traversal characters ('../') to access and write arbitrary files or to execute arbitrary files.

eXtplorer 2.1.9 is vulnerable; other versions may also be affected.

eXtplorer CVE-2016-4313 Local Directory Traversal Vulnerability

The researcher who discovered this issue has created a proof-of-concept. Please see the references for more information.

eXtplorer CVE-2016-4313 Local Directory Traversal Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

eXtplorer CVE-2016-4313 Local Directory Traversal Vulnerability

References:

• eXtplorer Homepage (eXtplorer)
  
• eXtplorer v2.1.9 Archive Path Traversal (John Page aka hyp3rlinx)