| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <1673765437.20031116124032@rsteam.ru>
Date: Sun, 16 Nov 2003 12:40:32 +0300
From: r00t@...eam.ru
To: bugtraq@...urityfocus.com
Subject: phpWebFileManager v2.0.0 - Directory traversal
############ ###################### ####################
################### ######################## #########################
###################### ##### #### #### ##################
#### #### #### ##### ###### ## #####
### ###### ######## ################# ################ ######
### ####### ### ######## ################ ############## ######
### ## ############### #### ######## #######
### ##### ######## ################## #### ######## #######
### ####### ###### ################## #### ###### #######
### ########## #### #### ########### #### ##### ########
### ##### ###### #### ####### ####### #############
######## ########## ###################### ##########
####### ######## ################# ######
##### RusH security team | http://www.rsteam.ru
o----------------------------=[ Advisory #12 ]=----------------------------o
oxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxo
o--------------------------------------------------------------------------o
| Product: phpWebFileManager |
| Version: 2.0.0 |
| Vulnerability: Directory traversal |
| OffSite: http://phpwebfilemgr.sourceforge.net |
| Vendor status: The vendor has been not informed |
o--------------------------------------------------------------------------o
| Date: 14/11/2003 |
| Author: 1dt.w0lf // RsT |
o--------------------------------------------------------------------------o
o-------------------------=[ Problem ]:::
phpWebFileManager version 2.0.0 is vulnerable for directory traversal.
Bug found in $f variable who don't check dots ".."
o------------------------=[ Example ]:::
Example:
www.site.com/phpwebfilemgr/index.php?f=../../../
o--------------------=[ for contacts ]:::
1dt.w0lf - idtwolf[at]pisem[dot]net
RusH team - r00t[at]rsteam[dot]ru
web - www.rsteam.ru
o------------------------------=[ RU ]:::
U can find ru version of this advisory here:
http://rst.void.ru/texts/advisory12.htm
o---------------------------------=[ EOF ]=--------------------------------o
Powered by blists - more mailing lists