Directory Traversal and Data Disclosure in RCBlog

Summary

Vulnerability
Directory Traversal and Data Disclosure in RCBlog
Discovered
2006.01.19
Last Update
0 n/a
ID
EV0042
CVE
CVE-2006-0370 CVE-2006-0371
Risk Level
high
Type
Sensitive Information Disclosure
Status
Unpatched
Vendor
n/a
Vulnerable Software
RCBlog (http://www.fluffington.com/)
Version
1.0.3 1.0.2 (1.0.2 - checked by Nicolas Cenciarini, nicolas@criston.com)
PoC/Exploit
Available
Solution
Not available
Discovered by
Aliaksandr Hartsuyeu (eVuln.com)

Description

Sensitive Information Disclosure found in RCBlog (http://www.fluffington.com/) script.

1. Directories data config are not protected by htaccess in default installiation. This can be used to retrieve registered user's information including logins and password's md5 hashes.

2. Directory traversal is possible.

Vulnerable script: index.php

Variable $_GET[post] isn't properly sanitized. This can be used to open arbitrary files with txt extention. Administrator's login and password is threatened.

Administrator has an ability to upload arbitrary files.

System access is possible.

PoC/Exploit

Directory traversal example:

http://host/rcblog/index.php?post=../config/password

Solution.

Solution for "Directory Traversal and Data Disclosure in RCBlog" is not available. Check vendor's website for updates.