Secunia

Some vulnerabilities have been discovered in Sisfo Kampus, which can be exploited by malicious people to gain knowledge of sensitive information or compromise a vulnerable system.

1) Input passed to the "slnt" parameter in index.php and print.php is not properly verified before being used to include files. This can be exploited to include arbitrary files from local or external resources.

2) Input passed to the "fn" parameter in downloadexcel.php and to the "f" parameter in dwoprn.php is not properly sanitised before being used to download files. This can be exploited to download arbitrary files via directory traversal attacks.

3) Input passed to the "nmf" parameter in blanko.preview.php is not properly verified before being used to read files. This can be exploited to read arbitrary files from local resources.

The vulnerabilities are confirmed in version 2006 (Semarang 3). Other versions may also be affected.

Solution
Edit the source code to ensure that input is properly verified and sanitised.

Provided and/or discovered by
Wawan Firmansyah a.k.a. Ang|n, an anonymous person, k-one and QTRinux.

Changelog
Further details available in Customer Area

Original Advisory
http://www.milw0rm.com/exploits/2847
http://milw0rm.com/exploits/4386
http://milw0rm.com/exploits/4380

Deep Links
Links available in Customer Area