https://www.exploit-db.com/exploits/26252
https://cxsecurity.com/issue/WLB-2005090004
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200509-143

SubscribeMePro是一款基于Web的邮件列表管理系统。SubscribeMePro在处理用户请求时存在输入验证漏洞，远程攻击者可能利用此漏洞遍历服务器目录，以Web进程权限访问任意文件。SubscribeMePro的s.pl脚本没有充分检查过滤l参数的内容，远程攻击者可以在数据中插入”../../”类似的目录遍历串，从而访问系统上的任意权限。

source: http://www.securityfocus.com/bid/14817/info

Subscribe Me Pro is prone to a directory traversal vulnerability. This is due to a lack of proper sanitization of user-supplied input.

Exploitation of this vulnerability could lead to a loss of confidentiality as arbitrary files are disclosed to an attacker. Information obtained through this attack may aid in further attacks against the underlying system.

Subscribe Me Pro 2.044.09P and prior are affected by this vulnerability.

http://www.example.com/[dir]/s.pl?e=1&subscribe=subscribe&l=../../../../../../../../etc/passwd%00&SUBMIT=%20%20Submit%20%20
http://www.example.com/[dir]/s.pl?e=enter%20your%20email%20address%20here&subscribe=subscribe&l=../../../../../../../../etc/passwd%00

来源:XF
名称:subscribemepro-unknown-directory-traversal(22249)
链接:http://xforce.iss.net/xforce/xfdb/22249
来源:BID
名称:14817
链接:http://www.securityfocus.com/bid/14817
来源:MISC
链接:http://www.h4cky0u.org/advisories/HYA-2005-007-subscribe-me-pro.txt
来源:SECUNIA
名称:16796
链接:http://secunia.com/advisories/16796/
来源:SREASON
名称:4
链接:http://securityreason.com/securityalert/4
来源:BUGTRAQ
名称:20050913SubscribeMePro2.044.09PandpriorDirectoryTraversal
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=112662785418368&w;=2