wodWebServer.NET Directory Traversal Vulnerability

Bugtraq ID:	47050
Class:	Input Validation Error
CVE:	CVE-2010-3743
Remote:	Yes
Local:	No
Published:	Mar 27 2011 12:00AM
Updated:	Mar 27 2011 12:00AM
Credit:	AutoSec Tools
Vulnerable:	WeOnlyDo! Software wodWebServer.NET 1.3.3
Not Vulnerable:

wodWebServer.NET Directory Traversal Vulnerability

wodWebServer.NET is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue will allow an attacker to view arbitrary local files within the context of the webserver. Information harvested may aid in launching further attacks.

wodWebServer.NET 1.3.3 is vulnerable; other versions may also be affected.

wodWebServer.NET Directory Traversal Vulnerability

An attacker can exploit this issue with a web browser.

The following example URI is available:

http://www.example.com/..%5C/..%5C/..%5C/..%5C/..%5C/..%5C/..%5C/..%5C/windows%5C/win.ini

wodWebServer.NET Directory Traversal Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

wodWebServer.NET Directory Traversal Vulnerability

References:

• wodWebServer.NET Product Page (WeOnlyDo! Software)