https://www.exploit-db.com/exploits/23635
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200412-972

NitiTelecomCaravanBusinessServer是一款基于WEB的服务程序。NitiTelecomCaravanBusinessServer包含的showcode.asp脚本对用户提交的请求缺少充分过滤，远程攻击者可以利用这个漏洞以WEB权限查看系统文件。使用包含多个’../’的转义字符作为参数提交给showcode.asp脚本，可绕过WEBROOT目录限制，以WEB进程权限查看系统文件。

source: http://www.securityfocus.com/bid/9555/info

The showcode.asp script activated in Sample_showcode.html may be vulnerable to a directory traversal issue. A remote attacker may view any files readable by the web server using '../' escape sequences in URI requests. 

http://www.example.org/sample_script_directory/Sample_showcode.html?fname=/../../../../target

来源:XF
名称:caravan-dotdot-directory-traveral(15004)
链接:http://xforce.iss.net/xforce/xfdb/15004
来源:BID
名称:9555
链接:http://www.securityfocus.com/bid/9555
来源:SECUNIA
名称:10763
链接:http://www.secunia.com/advisories/10763/
来源:members.lycos.co.uk
链接:http://members.lycos.co.uk/r34ct/main/Caravan/Caravan.txt
来源:OSVDB
名称:3787
链接:http://www.osvdb.org/3787
来源:SECTRACK
名称:1008913
链接:http://securitytracker.com/id?1008913
来源：NSFOCUS
名称：6002
链接：http://www.nsfocus.net/vulndb/6002