full-disclosure - phpBannerExchange 2.0 Directory Traversal Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <68cbfab10603070534q43266f34pd12d55e43f86ba27@mail.gmail.com>
Date: Tue Mar  7 13:34:24 2006
From: h4cky0u.org at gmail.com (h4cky0u)
Subject: phpBannerExchange 2.0 Directory Traversal
	Vulnerability

---------------------------------------------------------------------------
      HYSA-2006-004 h4cky0u.org Advisory 013
---------------------------------------------------------------------------
Date - Tue Mar 07 2006

TITLE:
======

phpBannerExchange 2.0 Directory Traversal Vulnerability

SEVERITY:
=========

High

SOFTWARE:
=========

phpBannerExchange 2.0 and prior

INFO:
=====

phpBannerExchange is a PHP/mySQL script that allows virtually anyone with
minimal knowledge of PHP, mySQL and web hosting to run their own banner
exchange. This script was inspired by some of the greatest ad rotation
scripts on the Internet such as Webadverts and phpAdsNew.

Support Website : www.eschew.net

DESCRIPTION:
============

A vulnerability has been identified in phpBannerExchange 2.0 and prior
versions, which may be exploited by remote attackers to access arbitrary
files outside of the webroot directory. This flaw is due to an input
validation error in the script "resetpw.php" that does not properly sanitize
the user-supplied input, which may be exploited by remote attackers to
retrieve arbitrary files from a vulnerable system.

POC:
====

Go to the lost password script (resetpw.php) and type in
../../../../../../../../etc/passwd as your email address. This shows us the
contents of the /etc/passwd file of the system hosting the vulnerable
script.

VENDOR STATUS
=============

Vendor was contacted repeatedly through email and on the support forums but
no response received till date.

FIX:
====

No fix available as of date.

CREDITS:
========

- This vulnerability was discovered and researched by -

TiX of h4cky0u Security Forums.

Mail : Rahigley dot 1989 at gmail dot com

Web : http://www.h4cky0u.org

- Co Researcher -

h4cky0u of h4cky0u Security Forums.

Mail : h4cky0u at gmail dot com

Web : http://www.h4cky0u.org

ORIGINAL ADVISORY:
==================

http://www.h4cky0u.org/advisories/HYSA-2006-004-phpbanner.txt
--
http://www.h4cky0u.org
(In)Security at its best...
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20060307/e1fb0c4e/attachment.html