deV!Lz ClanPortal "file" Parameter Handling Arbitrary File Disclosure Vulnerability


Description   A vulnerability has been identified in deV!Lz ClanPortal, which could be exploited by attackers to gain unauthorized access to arbitrary files on a vulnerable system. This issue is due to an input validation error in the "inc/filebrowser/browser.php" script that does not validate the "file" parameter, which could be exploited by malicious users to access and disclose the contents of arbitrary files.
     
Vulnerable Products   Vulnerable Software:
deV!Lz ClanPortal version 1.4.5 and prior
     
Solution   Upgrade to deV!Lz ClanPortal version 1.4.6 : http://www.dzcp.de/
     
CVE   CVE-2007-1167
     
References   http://dzcp.de/newscenter/index.php?action=show&id=1
     
Vulnerability Manager Detection   No
     
IPS Protection  
ASQ Engine alarm Available Since
Misc : Directory traversal - parameter starting with ../
3.2.0
Directory traversal using ..\..
3.2.0
Directory traversal
3.2.0
     


 
 
 
 
 Risk level 
Moderate 

 Vulnerability First Public Report Date 
2007-02-22 

 Target Type 
Server 

 Possible exploit 
Local & Remote