An issue was discovered in the Video Extension in Suprema BioStar 2 before 2.8.2. Remote attackers can read arbitrary files from the server via Directory Traversal.
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Link | Tags |
---|---|
https://www.supremainc.com/en/support/biostar-2-pakage.asp | vendor advisory |
http://packetstormsecurity.com/files/158576/Bio-Star-2.8.2-Local-File-Inclusion.html | third party advisory vdb entry exploit |