Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!

TUCoPS :: Web :: PHP :: b06-1668.htm

PhpWebFTP 3.2 Login Script

PhpWebFTP 3.2 Login Script
PhpWebFTP 3.2 Login Script

==============================================phpWebFTP enables connections to FTP servers, even behind a firewall not allowing traffic. phpWebFTP bypasses the firewall by making a FTP connection from your webserver to the FTP server and transfering the files to your webclient over the http protocol

Issue :
Well I have found that most of the sites that use phpwebftp v3.2 > less  have a problem. The user login script is a javascript file called script.js. This file validates the user input in the logon box. But to my surprise this file is directly accessed by web browser . The  disclosure of the source code can help an attacker to trigger    code injections .

Exploit : 

Further a directory traversal is possible via malicious arguments passed on the web browser using POST Method relative to the path of phpWebftp ie. . 


TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH