Distinct Intranet Servers Directory Traversal Vulnerability
BID:52938
Info
Distinct Intranet Servers Directory Traversal Vulnerability
| Bugtraq ID: | 52938 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 08 2012 12:00AM |
| Updated: | May 14 2012 10:50AM |
| Credit: | modpr0be |
| Vulnerable: |
Distinct Intranet Servers 3.01 |
| Not Vulnerable: | |
Discussion
Distinct Intranet Servers Directory Traversal Vulnerability
Distinct Intranet Servers is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input.
Remote attackers can use specially crafted requests with directory-traversal sequences ('../') to retrieve or upload arbitrary files in the context of the application.
Exploiting this issue may allow an attacker to retrieve or upload arbitrary files at arbitrary locations that could aid in further attacks.
Distinct Intranet Servers 3.01 is vulnerable; other versions may also be affected.
Distinct Intranet Servers is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input.
Remote attackers can use specially crafted requests with directory-traversal sequences ('../') to retrieve or upload arbitrary files in the context of the application.
Exploiting this issue may allow an attacker to retrieve or upload arbitrary files at arbitrary locations that could aid in further attacks.
Distinct Intranet Servers 3.01 is vulnerable; other versions may also be affected.
Exploit / POC
Distinct Intranet Servers Directory Traversal Vulnerability
An attacker can exploit the issue using standard tools.
The following exploit is available:
An attacker can exploit the issue using standard tools.
The following exploit is available:
Solution / Fix
Distinct Intranet Servers Directory Traversal Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
References
Distinct Intranet Servers Directory Traversal Vulnerability
References:
References:
- Distinct Homepage (Distinct)