[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

HTTP SERVER (httpsv1.6.2) source code disclosure

To: bugtraq@xxxxxxxxxxxxxxxxx
Subject: HTTP SERVER (httpsv1.6.2) source code disclosure
From: imprili@xxxxxxxxx
Date: 20 Jun 2007 20:17:37 -0000

HTTP SERVER (httpsv1.6.2) source code disclosure
http://httpsv.sourceforge.net/

The vulnerability is caused due to a parser error of the filename extension 
supplied by the user in the URL.
This can be exploited to retrieve the source code of script files.

POC: http://127.0.0.1/test.htm%20

Bug Found By: Prili - imprili[at]gmail.com

Prev by Date: [security bulletin] HPSBTU02218 SSRT071424 rev.1 - HP Tru64 UNIX Internet Express running Samba, Remote Arbitrary Code Execution or Local Unauthorized Privilege Elevation
Next by Date: MyServer-0.8.9 - source code disclosure
Previous by thread: [security bulletin] HPSBTU02218 SSRT071424 rev.1 - HP Tru64 UNIX Internet Express running Samba, Remote Arbitrary Code Execution or Local Unauthorized Privilege Elevation
Next by thread: MyServer-0.8.9 - source code disclosure
Index(es):
- Date
- Thread