Description
Directory traversal vulnerability in workspaces.php in phpXplorer 0.9.33 allows remote attackers to include arbitrary files via a .. (dot dot) and trailing null byte (%00) in the sShare parameter. NOTE: a followup post claims that this is not a vulnerability since the functionality of phpXplorer supports the upload of PHP files, which would not cross privilege boundaries since the PHP functionality would support read access outside the web root
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- PHPXplorer 0.9.33 - 'Workspaces.php' Directory Traversal EDB-27097 · webapps · Jan 16, 2006 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 20060116 Re: Directory traversal in phpXplorer mailing-list
- phpxplorer-sshare-directory-traversal(39982) vdb-entry
- 16263 vdb-entry
- http://www.arrelnet.com/advisories/adv20060116.html
- ADV-2006-0232 vdb-entry
- 18518 third-party-advisory
- 353 third-party-advisory
- 20060116 Directory traversal in phpXplorer mailing-list