PT-2009-22: EXcms Root directory disclosure vulnerability Affected SoftwareEXcms Versions prior to 2.02 Product Link: http://www.ekvixgroup.comSeverity Rating Severity: Low Impact: Root directory disclosure Attack Vector: RemoteCVSS v2Base Score: 0.0 Temporal Score: 0.0 Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:N/E:F/RL:T/RC:C) CVE: not assignedSoftware DescriptionEXcms is a content management system (CMS) software, usually implemented as a Web application, for creating and managing HTML content. It is used to manage and control a large, dynamic collection of Web material (HTML documents and their associated images).Vulnerability DescriptionPositive Technologies Research Team has discovered a Root directory disclosure vulnerability in EXcms.Application does not properly verify input data for HTTP header. This allows to call an exception that leads to web server root directory disclosure.An attacker may use the data to exploit another attacks.Details are not provided.SolutionNot available.Workaroundmagic_quotes on will fix the vulnerability.Disclosure Timeline03/03/2009 - Vendor notified 03/04/2009 - Vendor response 03/04/2009 - Requested status update from vendor 03/24/2009 - Second requested status update from vendor 05/26/2009 - Second requested status update from vendor 05/26/2009 - Vendor response 05/27/2009 - Public disclosureCreditsThis vulnerability was discovered by Dmitry Evteev (Positive Technologies Research Team) using professional network security scanner MaxPatrol.Referenceshttp://en.securitylab.ru/lab/PT-2009-22 http://www.ptsecurity.ru/advisory.aspComplete list of vulnerability reports published by Positive Technologies Research Team:http://en.securitylab.ru/lab/ http://www.ptsecurity.ru/advisory.asp
