Image Display System Directory Existence Disclosure Vulnerability
BID:4870
Info
Image Display System Directory Existence Disclosure Vulnerability
| Bugtraq ID: | 4870 |
| Class: | Configuration Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | May 28 2002 12:00AM |
| Updated: | May 28 2002 12:00AM |
| Credit: | Discovered by [email protected]. |
| Vulnerable: |
IDS IDS (Image Display System) 0.8.1 |
| Not Vulnerable: | |
Discussion
Image Display System Directory Existence Disclosure Vulnerability
IDS (Image Display System) is an web based photo album application written in Perl. IDS is freely available and is maintained by Ashley M. Kirchner.
Users can confirm the existence and location of various directories residing on the IDS host. This is accomplished when a request for a directory and album name is sent to the host containing numerous '../' character sequences. The error page returned will indicate to the attacker whether the specified path is a valid directory or not.
IDS (Image Display System) is an web based photo album application written in Perl. IDS is freely available and is maintained by Ashley M. Kirchner.
Users can confirm the existence and location of various directories residing on the IDS host. This is accomplished when a request for a directory and album name is sent to the host containing numerous '../' character sequences. The error page returned will indicate to the attacker whether the specified path is a valid directory or not.