Seagull PHP Framework *files* Information Disclosure

Posted on Friday, January 25, 2008 @ 21:25:21 PST in Security
by Raven

SECUNIA ADVISORY ID: SA28646

VERIFY ADVISORY: http://secunia.com/advisories/28646/

CRITICAL: Moderately critical

IMPACT: Exposure of system information, Exposure of sensitive information

SOFTWARE: Seagull PHP Framework 0.x - http://secunia.com/product/5387/

DESCRIPTION: fuzion has discovered a vulnerability in Seagull PHP Framework, which can be exploited by malicious people to disclose sensitive information.

Input passed to the "files" parameter in www/optimizer.php is not properly sanitised before being used. This can be exploited to display arbitrary files through directory traversal attacks. The vulnerability is confirmed in version 0.6.3 minimal and 0.6.3 full package. Other versions may also be affected.

SOLUTION: Edit the source code to ensure that input is properly sanitised.

PROVIDED AND/OR DISCOVERED BY: fuzion

ORIGINAL ADVISORY: http://milw0rm.com/exploits/4980
 
 
click Related        click Share
 
News ©

Site Info v2.2.2

Last SeenLast Seen
Server TrafficServer Traffic
  • Total: 346,396,860
  • Today: 449
Server InfoServer Info
  • Jan 23, 2018
  • 12:12 am PST
 
 

Daily Inspiration