9 lines
No EOL
734 B
Text
9 lines
No EOL
734 B
Text
source: https://www.securityfocus.com/bid/11517/info
|
|
|
|
It is reported that LinuxStat is vulnerable to a directory traversal vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied input.
|
|
|
|
By including '../' directory traversal sequences in the affected URI argument, attackers may reportedly cause the contents of arbitrary, potentially sensitive web-server readable files to be included in the output of the requested page. The resulting information disclosure may aid malicious users in further attacks.
|
|
|
|
Versions prior to 2.3.1 are reported to be affected by this vulnerability.
|
|
|
|
http://www.example.com/lstat/lstat.cgi?obj=wg104&template=../../../../../../../../etc/passwd&from=-1m&to=now |