Secunia

dr_insane has discovered two vulnerabilities in LogiSphere, which can be exploited by malicious users to access arbitrary files on a vulnerable system and potentially to cause a DoS (Denial of Service).

1) An input validation error in the URL makes it possible to escape the web root and retrieve arbitrary files on the system via directory traversal attacks using the "../../" character sequence.

2) The server does not limit the number of messages that can be sent by a user using the "msg" command. This may be exploited to display a large number of message boxes on the server via the "msg" command.

Example:
http://[host]:8080/msg[message]

The vulnerabilities have been confirmed in version 0.9.9j. Other versions may also be affected.

Solution
Update to version 1.2.
Further details available in Customer Area

Provided and/or discovered by
dr_insane

Changelog
Further details available in Customer Area

Original Advisory
http://www.ipomonis.com/advisories.htm

Deep Links
Links available in Customer Area