torrentialTraverse.txt

`I was poking around my own server because I had an installation of  
torrential and found this vuln. The problem lies in getdox.php. It  
works by taking an argument after a "/". This specifies a file. The  
DOX folder that it grabs the files from is located int /dox such that  
/ is the directory that the main index is in. Now, you can give it the  
parameter of /(any file) and it will fetch that file.  
  
EXAMPLES:  
http://www.example.com/torrential/dox/getdox.php/../forums.php (goes  
to the forums page)  
http://www.example.com/torrential/dox/getdox.php/../../index.html  
(goes to http://www.example.com/index.html in this case)  
  
LOCATION FOR DOWNLOAD:  
prdownloads.sourceforge.net/torrentbits/TBSource_-_Torrential_Beta_1.2-2005-09-25-1220-expert01.rar?download  
  
I have already taken preventative measures on my site.  
`