ideal_process.php in the iDEAL payment module in ViArt Shop 3.3 beta and earlier might allow remote attackers to obtain the pathname for certificate and key files via an "iDEAL transaction", possibly involving fopen error messages for nonexistent files, a different issue than CVE-2007-5364. NOTE: this can be leveraged for reading certificate or key files if an installation places these files under the web document root.
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
| Link | Tags |
|---|---|
| http://securityreason.com/securityalert/3233 | third party advisory |
| http://www.securityfocus.com/archive/1/481978/100/0/threaded | mailing list |
| http://www.viart.com/ideal_process_script_fix_for_release_32_and_33_beta.html | patch |
| http://osvdb.org/40151 | vdb entry |
| http://secunia.com/advisories/27199 | third party advisory patch vendor advisory |
| http://www.securityfocus.com/bid/25998 | vdb entry |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/37048 | vdb entry |