|
 |
| SecurityReason | ||
| WLB | ||
| Services | ||
| RSS | ||
| Corporate | ||
| Note | ||
If you have found a vulnerability, please send to our SecurityAlert Database : |
||
Home  SecurityAlert Database |
||||
SecurityAlert : 1395 CVE : CVE-2006-4161 SecurityRisk : Low  (About) Remote Exploit : Yes Local Exploit : No Exploit Given : Yes Credit : c boulton mybboard com Published : 18.08.2006
Advisory Text : --------------------- SUMMARY --------------------- Name: XennoBB "avatar gallery" directory transversal (10/8/2006) Vendor / Product: XennoBB Group http://www.xennobb.com/ Description: The world's most revolutionary and easy to use bulletin board. Revolutionary because it redefines the boundaries of usability and power; from the first version it's a real alternative to the commercial forums out there. How can XennoBB be described in few words? Lightning-speed, stable, SECURED(?) and modern. Version(s) Affected: <= 2.1.0 Severity: Medium Impact: Directory transversal (Remote) Status: Unpatched Discovered by: Chris Boulton <http://www.surfionline.com> Original advisory: http://www.surfionline.com/security_advisories/20060810_xennobb_avatar_g allery_transversal.txt ------------------- DESCRIPTION ------------------- An exploit exists in the above mentioned versions of XennoBB which can be exploited by malicious users to transverse various directories on the server. Input passed to the "gallery" parameter in profile.php is not properly sanitized before being used to open the corresponding directory on the file system. This exploit can lead to manipulation of content in higher up directories than the script intends. --------------------- EXPLOIT --------------------- Submit a forged POST request to profile.php?action=avatar_gallery&id={your registered user ID here} With the following as the POST data: category=../../general/ Successful exploitation leads to images in the /img/general folder being shown to the user. A similar process can be used to obtain other confidential system documents or images which may exist on the server. --------------------- SOLUTION -------------------- Ensure input is correctly sanitized and invalid/not acceptable characters are removed from the gallery POST variable before the directory is opened on the server.  Feedback : If you have additional information or notice any errors regarding this security advisory, please use contact form or email us at info()securityreason()com. |
||||
| Alert | ||
Multiple Vendors libc/gdtoa printf(3) Array Overrun
SecurityReason realised new advisory about vulnerabilities libc/gdtoa... |
||
| Apache |  |
|
» Apache Tomcat |
||
» Apache Tomcat User |
||
| PHP | |
|
» PHP |
||
- 2009-05-30| Copyright © SecurityReason.com. All Rights Reserved. |