SpamTitan WebTitan 3.50 logs-x.php fname path traversal

Summaryinfo

A vulnerability has been found in SpamTitan WebTitan 3.50 and classified as problematic. The impacted element is an unknown function of the file logs-x.php. The manipulation of the argument fname leads to path traversal. This vulnerability is uniquely identified as CVE-2011-4640. Moreover, an exploit is present. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in SpamTitan WebTitan 3.50 (Anti-Spam Software). This issue affects an unknown part of the file logs-x.php. The manipulation of the argument fname with an unknown input leads to a path traversal vulnerability. Using CWE to declare the problem leads to CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Impacted is confidentiality. The summary by CVE is:

Directory traversal vulnerability in logs-x.php in SpamTitan WebTitan before 3.60 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the fname parameter in a view action.

The weakness was disclosed 10/08/2012 (Website). The advisory is shared at sec-1.com. The identification of this vulnerability is CVE-2011-4640 since 11/29/2011. The exploitation is known to be easy. The attack may be initiated remotely. A simple authentication is necessary for exploitation. Technical details as well as a public exploit are known. MITRE ATT&CK project uses the attack technique T1006 for this issue.

The exploit is available at exploit-db.com. It is declared as proof-of-concept. By approaching the search of inurl:logs-x.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 3.50 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Exploit-DB (37943). The entries VDB-62596 and VDB-62595 are pretty similar. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Anti-Spam Software

Vendor

• SpamTitan

Name

• WebTitan

Version

• 3.50

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion