Directory Traversal and Data Disclosure in RCBlog
Summary
- Vulnerability
- Directory Traversal and Data Disclosure in RCBlog
- Discovered
- 2006.01.19
- Last Update
- 0 n/a
- ID
- EV0042
- CVE
- CVE-2006-0370 CVE-2006-0371
- Risk Level
- high
- Type
- Sensitive Information Disclosure
- Status
- Unpatched
- Vendor
- n/a
- Vulnerable Software
- RCBlog (http://www.fluffington.com/)
- Version
- 1.0.3 1.0.2 (1.0.2 - checked by Nicolas Cenciarini, nicolas@criston.com)
- PoC/Exploit
- Available
- Solution
- Not available
- Discovered by
- Aliaksandr Hartsuyeu (eVuln.com)
Description
Sensitive Information Disclosure found in RCBlog (http://www.fluffington.com/) script.
1. Directories data config are not protected by htaccess in default installiation. This can be used to retrieve registered user's information including logins and password's md5 hashes.
2. Directory traversal is possible.
Vulnerable script: index.php
Variable $_GET[post] isn't properly sanitized. This can be used to open arbitrary files with txt extention. Administrator's login and password is threatened.
Administrator has an ability to upload arbitrary files.
System access is possible.
PoC/Exploit
Directory traversal example:
http://host/rcblog/index.php?post=../config/password
Solution.
Solution for "Directory Traversal and Data Disclosure in RCBlog" is not available. Check vendor's website for updates.