Secunia

Osirys has discovered a security issue and a vulnerability in WorkSimple, which can be exploited by malicious people to disclose sensitive information and compromise a vulnerable system.

1) The security issue is caused due to missing access restrictions to the "data/usr.txt" file stored inside the web root. This can be exploited to gain knowledge of sensitive information (e.g. user names and password hashes) by requesting the file directly.

2) Input passed to the "lang" parameter in calendar.php is not properly sanitised before being used to include files. This can be exploited to include arbitrary files from local and external resources.

Successful exploitation requires that "register_globals" is enabled.

The security issue and the vulnerability are confirmed in version 1.2.1. Other versions may also be affected.

Solution
Update to version 1.3.0 or later.

Provided and/or discovered by
Osirys

Changelog
Further details available in Customer Area

Original Advisory
http://milw0rm.com/exploits/7481

Deep Links
Links available in Customer Area