https://www.exploit-db.com/exploits/20832
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200108-062

DrummondMilesA1Stats1.6之前版本存在目录遍历漏洞。远程攻击者可以借助(1)a1disp2.cgi、(2)a1disp3.cgi或(3)a1disp4.cgi中的’..’（点点）攻击读取任意文件。

source: http://www.securityfocus.com/bid/2705/info
 
A1Stats is a CGI product by Drummon Miles used to report on a website's visitor traffic.
 
Versions of this product fail to properly validate user-supplied input submitted as querystrings to the A1Stats script.
 
An attacker can compose a long path including '/../' sequences, and submit it as a file request to the product's built-in webserver. 'dot dot' sequences will not be filtered from the path, permitting the attacker to specify files outside the directory tree normally available to users.
 
This can permit disclosure of confidential data and sensitive system files which, if properly exploited, could lead to further compromises of the host's security.
 
Additionally, by appending a properly formatted echo command argumented by a filename writable by the webserver, this flaw allows the attacker to overwrite this file with A1Stats' output.

www.server.com/cgi-bin/a1stats/a1disp3.cgi?../../../../../../../etc/passwd

来源:US-CERTVulnerabilityNote:VU#471691
名称:VU#471691
链接:http://www.kb.cert.org/vuls/id/471691
来源:XF
名称:a1stats-dot-directory-traversal(6503)
链接:http://xforce.iss.net/static/6503.php
来源:BUGTRAQ
名称:20010507AdvisoryforA1Stats
链接:http://archives.neohapsis.com/archives/bugtraq/2001-05/0047.html
来源:BID
名称:2705
链接:http://www.securityfocus.com/bid/2705