https://www.exploit-db.com/exploits/21390
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200208-040

SambarWebserver是一款多线程的HTTP服务器，可使用于Windows、Unix、Linux操作系统下。SambarWebserver在服务端URL解析处理中存在漏洞，远程攻击者可以获得请求文件源代码信息。攻击者可以向SambarWebserver提交任何文件请求并在文件名后追加空格和NULL字符，可以导致SambarWebserver返回包含请求文件源代码信息，可能导致密码等敏感的信息泄露。攻击者同样可以请求DOS设备名进行拒绝服务攻击。

source: http://www.securityfocus.com/bid/4533/info

An issue has been discovered in Sambar Server, which could allow a user to reveal the source code of script files.

Submitting a request for a known script file along with a space and null character (%00), will successfully bypass the serverside URL parsing. 

http://server/cgi-bin/environ.pl+%00

来源:BID
名称:4533
链接:http://www.securityfocus.com/bid/4533
来源:XF
名称:sambar-script-source-disclosure(8876)
链接:http://www.iss.net/security_center/static/8876.php
来源:www.sambar.com
链接:http://www.sambar.com/security.htm
来源:OSVDB
名称:5123
链接:http://www.osvdb.org/5123
来源:BUGTRAQ
名称:20020417KPMG-2002012:SambarWebserverServersideFileparseBypass
链接:http://online.securityfocus.com/archive/1/268121
来源:VULNWATCH
名称:20020417[VulnWatch]KPMG-2002012:SambarWebserverServersideFileparseBypass
链接:http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0026.html