https://www.exploit-db.com/exploits/23897
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200403-139

LINBOX提供完成的IT解决方案，包括如防火墙，文件，邮件，代理服务器等。LINBOX的管理脚本存在设计错误，远程攻击者可以利用这个漏洞绕过验证未授权访问系统。LINBOX默认在8080口包含基于WEB的管理接口，默认Internet可连接，管理访问需要用户名和密码，但是攻击者可直接提交//admin/user.pl请求绕过验证，直接访问管理功能。另外通过访问users.pl，直接点击编辑，可从页面源代码中获得用户密码信息。而且这些帐户信息又是系统帐户可直接通过SSH等接口访问。

source: http://www.securityfocus.com/bid/10010/info

It has been reported that LINBOX is prone to a remote authentication bypass vulnerability. This issue is due to a design error that would allow access to web based administration scripts without proper authorization.

This issue may allow unauthorized user to gain access to the administration scripts of the affected system.

Issuing the following request to the affected server will provide access to the administration interface:
http://www.example.com//admin/user.pl

来源:XF
名称:linbox-slashslash-security-bypass(15677)
链接:http://xforce.iss.net/xforce/xfdb/15677
来源:BID
名称:10010
链接:http://www.securityfocus.com/bid/10010
来源:SECUNIA
名称:11264
链接:http://secunia.com/advisories/11264
来源:www.websec.org
链接:http://www.websec.org/adv/linbit.txt.html
来源:BUGTRAQ
名称:20040330LinbitlinboxMultipleVulnerabilities
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=108067245401673&w;=2