https://www.exploit-db.com/exploits/20281
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200012-091

Hassan咨询的shop.cgi购物栏程序存在目录遍历漏洞。远程攻击者借助页参数的..(点点)攻击读取任意文件。

source: http://www.securityfocus.com/bid/1777/info

The $page variable in Hassan Consulting Shopping Cart does not properly check for insecure relative paths such as the double dot "..". Therefore, requesting the following URL will display the specified file:

http://target/cgi-bin/shop.cgi/page=../../../path/filename.ext

Successful exploitation could lead to a remote intruder gaining read access to any known file.

来源:XF
名称:hassan-shopping-cart-dir-traversal
链接:http://xforce.iss.net/static/5342.php
来源:BID
名称:1777
链接:http://www.securityfocus.com/bid/1777
来源:OSVDB
名称:1596
链接:http://www.osvdb.org/1596
来源:BUGTRAQ
名称:20001007SecurityAdvisory:HassanConsulting’sshop.cgiDirectoryTraversalVulnerability.
链接:http://archives.neohapsis.com/archives/bugtraq/2000-10/0115.html