<<< Date Index >>>     <<< Thread Index >>>

phpBannerExchange 2.0 Directory Traversal Vulnerability



------------------------------------------------------
      HYSA-2006-004 h4cky0u.org Advisory 013
------------------------------------------------------
Date - Tue Mar 07 2006


TITLE:
======

phpBannerExchange 2.0 Directory Traversal Vulnerability


SEVERITY:
=========

High


SOFTWARE:
=========

phpBannerExchange 2.0 and prior


INFO:
=====

phpBannerExchange is a PHP/mySQL script that allows virtually anyone with 
minimal knowledge of PHP, mySQL and web hosting to run their own banner 
exchange. This script was inspired by some of the greatest ad rotation scripts 
on the Internet such as Webadverts and phpAdsNew.

Support Website : www.eschew.net


DESCRIPTION:
============

A vulnerability has been identified in phpBannerExchange 2.0 and prior 
versions, which may be exploited by remote attackers to access arbitrary files 
outside of the webroot directory. This flaw is due to an input validation error 
in the script "resetpw.php" that does not properly sanitize the user-supplied 
input, which may be exploited by remote attackers to retrieve arbitrary files 
from a vulnerable system.


POC:
====

Go to the lost password script (resetpw.php) and type in 
../../../../../../../../etc/passwd as your email address. This shows us the 
contents of the /etc/passwd file of the system hosting the vulnerable script.


VENDOR STATUS:
==============

Vendor was contacted repeatedly through email and on the support forums but no 
response received till date.


FIX:
====

No fix available as of date.


CREDITS:
========

- This vulnerability was discovered and researched by -

TiX of h4cky0u Security Forums.

Mail : Rahigley dot 1989 at gmail dot com

Web : http://www.h4cky0u.org


- Co Researcher -

h4cky0u of h4cky0u Security Forums.

Mail : h4cky0u at gmail dot com

Web : http://www.h4cky0u.org

ORIGINAL ADVISORY:
==================

http://www.h4cky0u.org/advisories/HYSA-2006-004-phpbanner.txt