OSVDB ID: 23918 Title: Horde go.php url Parameter Arbitrary File Access |
Info |
|
|
Dates |
||||
|
|
Description |
Horde contains a flaw that may lead to an unauthorized information disclosure. The issue is due to go.php not properly sanitizing user input supplied to the 'url' variable. Embedding a NULL character within the 'url' variable enables an attacker to control the variable passed to readfile() function leading to the reading of any file on the file system with the privileges of the web server resulting in a loss of confidentiality. |
Classification |
Location:
Remote / Network Access
Attack Type: Input Manipulation Impact: Loss of Confidentiality Solution: Upgrade Exploit: Exploit Public Disclosure: OSVDB Verified, Vendor Verified OSVDB: Web Related |
Solution |
Upgrade to version 3.1 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds. |
Products |
|
References |
|
Credit |
|
security-assessment.com - Security-Assessment.com