LightNEasy v.1.2.2 flat Multiple Vulnerabilities

LightNEasy v.1.2.2 flat Multiple Vulnerabilities

Author: Gerendi Sandor Attila
Date: April 14, 2008
Package: LightNEasy
Product homepage: http://lightneasy.uni.cc/
Versions Affected: v.1.2.2 (Other versions may also be affected)
Severity: High

1. Cross-Site Scripting (XSS):
   Input passed to "page" in "index.php" and "LightNEasy.php" is not properly sanitised before being used. This can be
   exploited to insert arbitrary HTML and script code, which is executed in a user's browser session in context of an
   affected site when malicious data is viewed.
   Examples:
   http://somehost/LightNEasy_1_2_2_flat/index.php?page=%00</title><script>alert("xss")</script>
   http://somehost/LightNEasy_1_2_2_flat/LightNEasy.php?page=%00</title><script>alert("xss")</script>

2. Directory Traversal:
   Input passed to "page" in "index.php" and "LightNEasy.php" is not properly sanitised before being used to include files.
   This can be exploited to include arbitrary files from local resources.
   Example:
   http://somehost/LightNEasy_1_2_2_flat/LightNEasy.php?page=../../../../../../../include.txt%00
   or:

3. Arbitrary File Creation:
   Input passed to "page" in "index.php" and "LightNEasy.php" is not properly sanitised before being used to create files.

Status:

1. Contacted the author at April 14, 2008 via http://www.lightneasy.org/contact.php.
2. A Security patch was released on April 15, 2008.