OSVDB ID: 33879 Title: Advanced Guestbook index.php lang Cookie Variable Path Disclosure |
Info |
|
|
Dates |
||||
|
|
Description |
Advanced Guestbook contains a flaw that allows a remote attacker to view arbitrary files on the system outside of the web path. The issue is due to the 'index.php' not properly sanitizing user input, specifically directory traversal style attacks (../../) supplied via the 'lang' cookie parameter. |
Classification |
Location:
Remote / Network Access
Attack Type: Information Disclosure Impact: Loss of Confidentiality Exploit: Exploit Public OSVDB: Web Related |
Solution |
Currently, there are no known upgrades, patches, or workarounds available to correct this issue. |
Products |
Unknown or Incomplete |
References |
|
Credit |
Unknown or Incomplete |