Two vulnerabilities have been reported in Easy File Sharing Web Server allowing malicious people to see any file and conduct Cross Site Scripting attacks.

One problem is that the web server doesn't verify requests. This allows malicious people to conduct directory traversal using "../" sequences making it possible to escape the web root.

Example:
http://[victim]/../../

The other problem is that it is possible to include arbitrary HTML and JavaScript in messages in the forum. This can be exploited to conduct permanent Cross Site Scripting.

The vulnerabilities have been confirmed in version 1.2.

Solution
Restrict access using a firewall so that only trusted IP addresses can access the service or use a different product.

Provided and/or discovered by
dr_insane

Deep Links
Links available in Customer Area