OSVDB ID: 25451 Title: Online Universal Payment System index.php read Parameter Traversal Arbitrary File Access |
Info |
|
|
Dates |
||||
|
|
Description |
Online Universal Payment System contains a flaw that allows a remote attacker to disclose the content of arbitrary files outside of the web path. The issue is due to the index.php not properly sanitizing user, specifically directory traversal style attacks (../../) supplied via the 'read' variable. |
Classification |
Location:
Remote / Network Access
Attack Type: Input Manipulation Impact: Loss of Confidentiality Exploit: Exploit Rumored OSVDB: Web Related |
Solution |
Currently, there are no known upgrades, patches, or workarounds available to correct this issue. |
Products |
|
References |
|
Credit |
|
email.com - RootShell Security Group