HYSA-2006-004 h4cky0u.org Advisory 013
Date - Tue Mar 07 2006
phpBannerExchange 2.0 Directory Traversal Vulnerability
High
phpBannerExchange 2.0 and prior
phpBannerExchange is a PHP/mySQL script that allows virtually anyone with minimal knowledge of PHP, mySQL
and web hosting to run their own banner exchange. This script was inspired by some of the greatest ad
rotation scripts on the Internet such as Webadverts and phpAdsNew.
Support Website : www.eschew.net
A vulnerability has been identified in phpBannerExchange 2.0 and prior versions, which may be exploited by
remote attackers to access arbitrary files outside of the webroot directory. This flaw is due to an input
validation error in the script "resetpw.php" that does not properly sanitize the user-supplied input, which
may be exploited by remote attackers to retrieve arbitrary files from a vulnerable system.
Go to the lost password script (resetpw.php) and type in …/…/…/…/…/…/…/…/etc/passwd as your email
address. This shows us the contents of the /etc/passwd file of the system hosting the vulnerable script.
Vendor was contacted repeatedly through email and on the support forums but no response received till date.
No fix available as of date.
TiX of h4cky0u Security Forums.
Mail : Rahigley dot 1989 at gmail dot com
Web : http://www.h4cky0u.org
h4cky0u of h4cky0u Security Forums.
Mail : h4cky0u at gmail dot com
Web : http://www.h4cky0u.org
http://www.h4cky0u.org/advisories/HYSA-2006-004-phpbanner.txt