full-disclosure - Re: Torrential 1.2 getdox.php Directory Traversal

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <f1d746770511221424n491ead07x@mail.gmail.com>
Date: Wed Nov 23 02:37:31 2005
From: shell6 at gmail.com (Shell)
Subject: Re: Torrential 1.2 getdox.php Directory Traversal

There is also a XSS vulnerablility present.

PoC:
http://www.example.com/torrential/dox/getdox.php/<script>alert("hi")</script>

2005/11/21, Shell <shell6@...il.com>:
> I was poking around my own server because I had an installation of
> torrential and found this vuln. The problem lies in getdox.php. It
> works by taking an argument after a "/". This specifies a file. The
> DOX folder that it grabs the files from is located int /dox such that
> / is the directory that the main index is in. Now, you can give it the
> parameter of /(any file) and it will fetch that file.
>
> EXAMPLES:
> http://www.example.com/torrential/dox/getdox.php/../forums.php (goes
> to the forums page)
> http://www.example.com/torrential/dox/getdox.php/../../index.html
> (goes to http://www.example.com/index.html in this case)
>
> LOCATION FOR DOWNLOAD:
> prdownloads.sourceforge.net/torrentbits/TBSource_-_Torrential_Beta_1.2-2005-09-25-1220-expert01.rar?download
>
> I have already taken preventative measures on my site.
>