HTB22907: Directory Traversal in Collabtive

Vulnerability ID: HTB22907
Reference: http://www.htbridge.ch/advisory/directory_traversal_in_collabtive.html
Product: Collabtive
Vendor: Open Dynamics ( http://collabtive.o-dyn.de/ )
Vulnerable Version: 0.6.5 and probably prior versions
Vendor Notification: 17 March 2011
Vulnerability Type: Directory Traversal Vulnerability
Risk level: Medium
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/)

Vulnerability Details:
An attacker can disclose arbitrary image file content.

The vulnerability exists due to failure in the "thumb.php" script to properly sanitize user-supplied input in "pic" variable.

Attacker can use browser to exploit this vulnerability. The following PoC is available:
http://host/thumb.php?pic=./../../../../../tmp/photo.jpg