Phreebooks 2.0 – Directory Traversal
Advisory Name: Directory Traversal in Phreebooks v2.0 Internal Cybsec Advisory Id: Vulnerability Class: Directory Traversal Release Date: 2010-05-26 Affected Applications: Phreebooks v2.0 Affected Platforms: Any running Phreebooks v2.0 Local / Remote: Remote Severity: Medium – CVSS: 5 (AV:N/AC:L/Au:N/C:P/I:N/A:N) Researcher: Gustavo Sorondo Vendor Status: N/A Reference to Vulnerability Disclosure Policy: http://www.cybsec.com/vulnerability_policy.pdf Vulnerability Description: A vulnerability has been found in Phreebooks v2.0 which allows malicious people to access local files by entering special characters in variables used to create file paths. The attackers use “../” sequences to move up to root directory, thus permitting navigation through the file system. Download: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/13778.pdf (cybsec_advisory_2010_0601_Phreebooks_v2_0_Directory_Traversal.pdf) |