[41583] in bugtraq
Torrential 1.2 Directory Traversal
daemon@ATHENA.MIT.EDU (Shell)
Sat Dec 10 13:40:33 2005
Message-ID: <f1d746770512091432r55c6a4aag@mail.gmail.com>
Date: Fri, 9 Dec 2005 17:32:23 -0500
From: Shell <shell6@gmail.com>
To: bugtraq@securityfocus.com
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
I was poking around my own server because I had an installation of
torrential and found this vuln. The problem lies in getdox.php. It
works by taking an argument after a "/". This specifies a file. The
DOX folder that it grabs the files from is located int /dox such that
/ is the directory that the main index is in. Now, you can give it the
parameter of /(any file) and it will fetch that file.
EXAMPLES:
http://www.example.com/torrential/dox/getdox.php/../forums.php (goes
to the forums page)
http://www.example.com/torrential/dox/getdox.php/../../index.html
(goes to http://www.example.com/index.html in this case)
The vulnerability lies in the fact that getdox.php directly reads the
file with fopen/fread.
