MuddyDogPaws FileDownload "download.php" Arbitrary File Download Vulnerability


Description   A vulnerability has been identified in MuddyDogPaws FileDownload, which could be exploited by attackers to gain knowledge of sensitive information. This issue is due to an input validation error in the "download.php" script that does not validate user-supplied parameters, which could be exploited by malicious users to download arbitrary files from a vulnerable web server.
     
Vulnerable Products   Vulnerable Software:
MuddyDogPaws FileDownload (snippet for MODx) versions prior to 2.5
     
Solution   Upgrade to FileDownload version 2.5 : http://www.muddydogpaws.com/notebook/filedownload-2.5.html&d=FileDownload2.5.zip
     
CVE   CVE-2007-0659
     
References   http://www.muddydogpaws.com/notebook/filedownload-2.5.html
http://modxcms.com/forums/index.php/topic
10470.0.html
     
Vulnerability Manager Detection   No
     
IPS Protection  
ASQ Engine alarm Available Since
Misc : Directory traversal - parameter starting with ../
3.2.0
Directory traversal using ..\..
3.2.0
Directory traversal
3.2.0
     


 
 
 
 
 Risk level 
Moderate 

 Vulnerability First Public Report Date 
2007-01-31 

 Target Type 
Server 

 Possible exploit 
Local & Remote