Mega File Manager File Disclosure and Local File Inclusion Vulnerabilities


Description   Two vulnerabilities have been discovered in Mega File Manager, which can be exploited by malicious people to disclose sensitive information.
1) Input passed via the "page" parameter to index.php is not properly verified before being used to include files. This can be exploited to include arbitrary files from local resources via directory traversal attacks and URL-encoded NULL bytes.
2) Input passed via the "name" parameter to cimages.php is not properly verified before being used to display files. This can be exploited to disclose the contents of arbitrary files via directory traversal sequences.
Successful exploitation requires that "magic_quotes_gpc" is disabled.
The vulnerabilities are confirmed in version 1.0. Other versions may also be affected.
     
Vulnerable Products   Vulnerable Software:
Mega File Manager 1.x
     
Solution   Edit the source code to ensure that input is properly verified.
     
CVE   CVE-2009-2263
     
References   SirGod:
http://www.exploit-db.com/exploits/9025/
Min Gi Jo:
http://www.exploit-db.com/exploits/18768/
     
Vulnerability Manager Detection   No
     
IPS Protection  
ASQ Engine alarm Available Since
Misc : Directory traversal - parameter starting with ../
3.2.0
PHP : Remote file inclusion prevention : suspicious root_path parameter found in URL
3.2.0
Directory traversal using ..\..
3.2.0
Directory traversal
3.2.0
PHP : Remote file inclusion prevention : URL found as parameter
3.2.0
Directory traversal backward root folder
3.2.0
Escaped NULL char in URL
3.2.0
Misc : Local File Inclusion - suspicious /etc/passwd found in URL
3.5.0
     


 
 
 
 
 Risk level 
Moderate 

 Vulnerability First Public Report Date 
2009-06-29 

 Target Type 
Server 

 Possible exploit 
Remote