https://www.exploit-db.com/exploits/19808
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200003-027

Sojourn是一个商业搜索引擎软件。主页是http://www.generationterrorists.com/sojourn_superuser.htmlSojourn存在一个安全问题，可导致系统文件内容泄露。在正运行这个软件的Web服务器上，任何WebServer有权读取的文件都可能泄露给远程攻击者。Sojourn软件可以将一个Web站点分类组织，这些类别可以通过sojourn.cgi(Perl脚本)来访问，通常是用下列请求实现：http://target/cgi-bin/sojourn.cgi?cat=categoryname每一类都有一个与categoryname(类别名)对应的.txt文件.这个程序将在’cat’变量中的内容后面增加’.txt’扩展名，然后显示它的内容。然而这个程序允许攻击者在’cat’变量内容中输入’../’字符串，因此，攻击者可以访问Web服务器上任意的.txt文件(如果Webserver有读权限的话)，这个限制也能很容易的被绕过，攻击者只要在所要求的文件后面加上%00，就会屏蔽掉后面所加的.txt后缀。

source: http://www.securityfocus.com/bid/1052/info

Any file that the webserver has read access to can be read on a server running the Sojourn search engine.

The Sojourn software includes the ability to organize a website into categories. These categories can then be accessed via the sojourn.cgi Perl script. This is done by making a request for a URL like:

http ://target/cgi-bin/sojourn.cgi?cat=categoryname

Each category has an associated .txt file based on the category name. The program appends the .txt extension onto the contents of the 'cat' variable. However, the program will accept and follow the '../' string in the variable contents, allowing read access to any .txt file the webserver can read.

This restriction can be bypassed by appending %00 to the end of the requested file, which will prevent the .txt extension from being used in the filename.

http ://target/cgi-bin/sojourn.cgi?cat=../../../../../../etc/passwd%00

来源:BID
名称:1052
链接:http://www.securityfocus.com/bid/1052
来源:NTBUGTRAQ
名称:20000313SOJOURNSearchengineexposesfiles
链接:http://archives.neohapsis.com/archives/ntbugtraq/2000-q1/0201.html
来源:XF
名称:sojourn-file-read(4197)
链接:http://xforce.iss.net/static/4197.php
来源：NSFOCUS
名称：391
链接：http://www.nsfocus.net/vulndb/391