CVE-2005-3929

Vulnerability

A directory traversal vulnerability exists in the create function of xarMLSXML2PHPBackend.php in Xaraya version 1.0. The flaw allows remote attackers to traverse directories by injecting .. sequences into the module parameter passed to index.php. No authentication is required to reach the vulnerable code path.

Exploitation

An attacker can send a crafted HTTP request to index.php with a module parameter containing ../ sequences. The vulnerable function does not sanitize the input, enabling the attacker to specify arbitrary file paths. The attack requires no special privileges or user interaction; only network access to the Xaraya instance is needed.

Impact

Successful exploitation allows the attacker to create directories and overwrite arbitrary files on the server. This can lead to arbitrary code execution if the attacker overwrites executable files (e.g., PHP scripts) or configuration files, potentially compromising the entire application and underlying system.

Mitigation

As of the publication date (2005-11-30), no patch or fixed version was available in the provided references [1]. Users should monitor the Xaraya project for updates or apply input validation to the module parameter as a temporary workaround. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.