Full Disclosure mailing list archives
Re: Torrential 1.2 getdox.php Directory Traversal
From: Shell <shell6 () gmail com>
Date: Tue, 22 Nov 2005 17:24:26 -0500
There is also a XSS vulnerablility present. PoC: http://www.example.com/torrential/dox/getdox.php/<script>alert("hi")</script> 2005/11/21, Shell <shell6 () gmail com>:
I was poking around my own server because I had an installation of torrential and found this vuln. The problem lies in getdox.php. It works by taking an argument after a "/". This specifies a file. The DOX folder that it grabs the files from is located int /dox such that / is the directory that the main index is in. Now, you can give it the parameter of /(any file) and it will fetch that file. EXAMPLES: http://www.example.com/torrential/dox/getdox.php/../forums.php (goes to the forums page) http://www.example.com/torrential/dox/getdox.php/../../index.html (goes to http://www.example.com/index.html in this case) LOCATION FOR DOWNLOAD: prdownloads.sourceforge.net/torrentbits/TBSource_-_Torrential_Beta_1.2-2005-09-25-1220-expert01.rar?download I have already taken preventative measures on my site.
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Torrential 1.2 getdox.php Directory Traversal Shell (Nov 22)
- Re: Torrential 1.2 getdox.php Directory Traversal Shell (Nov 22)