vendor:
WebED
by:
Unknown
7.5
CVSS
HIGH
Remote File Disclosure
22
CWE
Product Name: WebED
Affected Version From: v0.0.9
Affected Version To: v0.0.9
Patch Exists: NO
Related CWE:
CPE: a:webed:webed:0.0.9
Platforms Tested:
2007
WebED v0.0.9 (index.php) Remote File Disclosure Vulnerabilities
The vulnerability exists in the index.php file of WebED v0.0.9. The code in the file allows an attacker to read arbitrary files on the server by manipulating the 'Root' and 'Path' parameters in the URL. By including '../' in the parameters, an attacker can navigate to sensitive files such as '/etc/passwd'. This vulnerability can be exploited remotely.
Mitigation:
To mitigate this vulnerability, it is recommended to update to a newer version of WebED or apply a patch provided by the vendor. Additionally, ensure that the 'Root' and 'Path' parameters are properly validated and sanitized to prevent directory traversal attacks.
