FUDforum 3.0.6: LFIDate: 2016-11-10 10:37:03
|Affected Product:||FUDforum 3.0.6|
|Fixed in:||not fixed|
|Fixed Version Link:||n/a|
|Reported to vendor:||04/11/2016|
|Disclosed to public:||11/10/2016|
|Release mode:||Full Disclosure|
|Credits||Tim Coen of curesec GmbH|
FUDforum is forum software written in PHP. In version 3.0.6, it is vulnerable to local file inclusion. This allows an attacker to read arbitrary files that the web user has access to.
Admin credentials are required.
CVSS: Medium 4.0 AV:N/AC:L/Au:S/C:P/I:N/A:N
Description: The "file" parameter of the hlplist.php script is vulnerable to directory traversal, which allows the viewing of arbitrary files.
Proof of Concept:
This issue was not fixed by the vendor.
5. Report Timeline
|04/11/2016||Informed Vendor about Issue (no reply)|
|09/14/2016||Reminded Vendor (no reply)|
|11/10/2016||Disclosed to public|