Full Disclosure: Re: Torrential 1.2 getdox.php Directory Traversal

[Shell <shell6 () gmail com>]

There is also a XSS vulnerablility present.

PoC:
http://www.example.com/torrential/dox/getdox.php/<script>alert("hi")</script>

2005/11/21, Shell <shell6 () gmail com>:
> I was poking around my own server because I had an installation of
> torrential and found this vuln. The problem lies in getdox.php. It
> works by taking an argument after a "/". This specifies a file. The
> DOX folder that it grabs the files from is located int /dox such that
> / is the directory that the main index is in. Now, you can give it the
> parameter of /(any file) and it will fetch that file.
>
> EXAMPLES:
> http://www.example.com/torrential/dox/getdox.php/../forums.php (goes
> to the forums page)
> http://www.example.com/torrential/dox/getdox.php/../../index.html
> (goes to http://www.example.com/index.html in this case)
>
> LOCATION FOR DOWNLOAD:
> prdownloads.sourceforge.net/torrentbits/TBSource_-_Torrential_Beta_1.2-2005-09-25-1220-expert01.rar?download
>
> I have already taken preventative measures on my site.
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/