10 lines
No EOL
746 B
Text
10 lines
No EOL
746 B
Text
source: https://www.securityfocus.com/bid/4882/info
|
|
|
|
Gafware's CFXImage is a custom tag for ColdFusion.
|
|
|
|
A program included with the CFXImage documentation doesn't properly filter its input. It is reported that a flaw exists in this program that allows a malicious user to read files outside of the permitted directory structure. By using directory traversal sequences (i.e. '/../', '..') or specifying a filename, an attacker can obtain files that may contain potentially sensitive information.
|
|
|
|
http://www.server.com/docs/showtemp.cfm?TYPE=JPEG&FILE=c:\boot.ini
|
|
http://www.server.com/docs/showtemp.cfm?TYPE=JPEG&FILE=../../../../../../../../../../../../../../../../../../boot.ini
|
|
|
|
This allows the attacker to view the contents of 'c:\boot.ini'. |