Ravens PHP Scripts - Seagull PHP Framework *files* Information Disclosure

SECUNIA ADVISORY ID: SA28646

VERIFY ADVISORY: http://secunia.com/advisories/28646/

CRITICAL: Moderately critical

IMPACT: Exposure of system information, Exposure of sensitive information

SOFTWARE: Seagull PHP Framework 0.x - http://secunia.com/product/5387/

DESCRIPTION: fuzion has discovered a vulnerability in Seagull PHP Framework, which can be exploited by malicious people to disclose sensitive information.

Input passed to the "files" parameter in www/optimizer.php is not properly sanitised before being used. This can be exploited to display arbitrary files through directory traversal attacks. The vulnerability is confirmed in version 0.6.3 minimal and 0.6.3 full package. Other versions may also be affected.

SOLUTION: Edit the source code to ensure that input is properly sanitised.

PROVIDED AND/OR DISCOVERED BY: fuzion

ORIGINAL ADVISORY: http://milw0rm.com/exploits/4980