LightNEasy v.1.2.2 flat Multiple Vulnerabilities
Author: Gerendi Sandor Attila
Date: April 14, 2008
Package: LightNEasy
Product homepage: http://lightneasy.uni.cc/
Versions Affected: v.1.2.2 (Other versions may also be affected)
Severity: High
Cross-Site Scripting (XSS):
Input passed to "page" in "index.php" and "LightNEasy.php" is not properly sanitised before being used. This can be
exploited to insert arbitrary HTML and script code, which is executed in a user's browser session in context of an
affected site when malicious data is viewed.
Examples:
http://somehost/LightNEasy_1_2_2_flat/index.php?page=%00</title><script>alert("xss")</script>
http://somehost/LightNEasy_1_2_2_flat/LightNEasy.php?page=%00</title><script>alert("xss")</script>
Directory Traversal:
Input passed to "page" in "index.php" and "LightNEasy.php" is not properly sanitised before being used to include files.
This can be exploited to include arbitrary files from local resources.
Example:
http://somehost/LightNEasy_1_2_2_flat/LightNEasy.php?page=../../../../../../../include.txt%00
or:
Arbitrary File Creation:
Input passed to "page" in "index.php" and "LightNEasy.php" is not properly sanitised before being used to create files.
Status: