Exploit extropia webstore 1.0/2.0 - Directory Traversal

Exploiter

Хакер
34,599
0
18 Дек 2022
EDB-ID
20279
Проверка EDB
  1. Пройдено
Автор
F0BIC
Тип уязвимости
REMOTE
Платформа
CGI
CVE
cve-2000-1005
Дата публикации
2000-10-09
Код:
source: https://www.securityfocus.com/bid/1774/info

Extropia WebStore is an e-commerce shopping cart application consisting of routines for error handling, order processing, encrypted mailing, frames, Javascript and VBscript.

The routine web_store.cgi does not properly handle the $file_extension variable if null characters are used.

For example if the following URL was requested, the file in question would not be delivered to the user:

http://target/cgi-bin/Web_Store/web_store.cgi?page=../../../path/filename.ext

However, by using the escaped character "%00", the requested file would be accessed successfully:

http://target/cgi-bin/Web_Store/web_store.cgi?page=../../../path/filename%00ext

Successful exploitation could lead to a remote intruder gaining read access to any known file.
 
Источник
www.exploit-db.com

Похожие темы