Baby Web Server URL File Disclosure Vulnerability

Bugtraq ID:	34772
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 29 2009 12:00AM
Updated:	Apr 30 2009 05:26PM
Credit:	ZoRLu
Vulnerable:	Pablo Software Solutions Baby Web Server 2.7.2
Not Vulnerable:

Baby Web Server URL File Disclosure Vulnerability

Baby Web Server is prone to a vulnerability that lets attackers obtain potentially sensitive information because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to download arbitrary files with the privileges of the webserver process. Information obtained may aid in further attacks.

Baby Web Server 2.7.2 is vulnerable; other versions may also be affected.

Baby Web Server URL File Disclosure Vulnerability

Attackers can use a browser to exploit this issue.

The following example exploit is available:

• /data/vulnerabilities/exploits/34772.php

Baby Web Server URL File Disclosure Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Baby Web Server URL File Disclosure Vulnerability

References:

• Baby Web Server Homepage (Pablo Software Solutions)