phpfss-traverse.txt

`PHP File Sharing System - Directory traversal  
+--------------------------------------------+  
  
Author: Jonas Thambert  
Date: 2007-10-13  
URL: http://sourceforge.net/projects/phpfilesadmin/  
Vendor Notified.  
Version: 1.5.1 (latest)  
  
  
[- Description -]  
  
PHP File Sharing System is vulnerable to directory traversal due to   
insufficient security validation and sanitization of user-data. The   
vulnerability allows the attacker to list directories, delete   
files and create new directories on the system with the same   
permission as the webbserver-user.  
  
Example - List /tmp directory:  
http://www.xxxx.nu/fss/index.php?cam=/../../../../../../../../../../  
../tmp  
  
To create dirs and delete files simple use the buttons in the   
webbinterface.  
  
  
[- Code Location -]  
The vulnerable code is located in the index.php file. The   
"$_GET['cam']" is the indata that needs to be checked and   
sanitized.   
  
  
[- Exploit -]  
Not needed.  
  
`