JVN#13794955: Source code of Old_GSI_Maps prior to January, 2015 vulnerable to directory traversal

kml2jsonp.php contained in source code of Old_GSI_Maps prior to January, 2015 provided by the Geospatial Information Authority of Japan (GSI) contains a directory traversal vulnerability (CWE-22).

Impact

When the product is used in Windows, a remote attacker may obtain arbitrary files from the server where the product is running.

Solution

Apply the update
Update kml2jsonp.php according to the information provided by the developer.

The developer recommends using “The source of GSI Maps”, which is the source code of GSI_Maps currently being maintained by GSI.

Products Affected

• Old_GSI_Maps that was available through GitHub prior to May 25th, 2016