LightNEasy v.1.2.2 flat Multiple Vulnerabilities
LightNEasy v.1.2.2 flat Multiple Vulnerabilities
Author: Gerendi Sandor Attila
Date: April 14, 2008
Package: LightNEasy
Product homepage: http://lightneasy.uni.cc/
Versions Affected: v.1.2.2 (Other versions may also be affected)
Severity: High
1. Cross-Site Scripting (XSS):
Input passed to "page" in "index.php" and "LightNEasy.php" is not properly
sanitised before being used. This can be exploited to insert arbitrary HTML and
script code, which is executed in a user's browser session in context of an
affected site when malicious data is viewed.
Examples:
http://somehost/LightNEasy_1_2_2_flat/index.php?page=%00</title><script>alert("xss")</script>
http://somehost/LightNEasy_1_2_2_flat/LightNEasy.php?page=%00</title><script>alert("xss")</script>
2. Directory Traversal:
Input passed to "page" in "index.php" and "LightNEasy.php" is not properly
sanitised before being used to include files. This can be exploited to include
arbitrary files from local resources.
Example:
http://somehost/LightNEasy_1_2_2_flat/LightNEasy.php?page=../../../../../../../include.txt%00
or:
3. Arbitrary File Creation:
Input passed to "page" in "index.php" and "LightNEasy.php" is not properly
sanitised before being used to create files.
Status:
1. Contacted the author at April 14, 2008 via
http://www.lightneasy.org/contact.php.
2. A Security patch was released on April 15, 2008.