Re: Wikepage Opus 13 2007.2 Directory Traversal Vulnerbility

[yeppy@xxxxxxxxxxxx]

"
vulnerability Path :

vuln code in [localhost]/wikepage/index.php

Sample Of vulnerabil Line : $ templatefile=$_GET['template']; (Line 586) And 
More .....
"

Fake advisory:


// load page content
function showpage($file) {
        global $pagevars, $wiki_get, $langu;
        // load file
        $raw=implode("", file($file) );
        // load menu
        $raw2=implode("", file('data/'.$langu.'_menu.txt') );
        // filter!
        $image=$_GET['image'];
        secure($image);
        if ($image){
        $raw="[".$image."]";
        }
        $content=filter( $raw ) . $content;
        $menucontent=filter( $raw2 ) . $menucontent;
        // load template
        // Checks Query string for Template variable, and uses specified 
template or defaults to index.html
        $templatefile=$_GET['template'];
        if($templatefile=="")
                $templatefile="index.html";
        $template=implode( "", 
file('theme/'.$pagevars["theme"].'/'.$templatefile) );
        $whole=str_replace("<!--wikicontent-->",$content,$template);
        $whole=str_replace("<!--menucontent-->",$menucontent,$whole);
        output( $whole, $file );
}

function editpage($file) {