邪恶八进制信息安全团队技术讨论组's Archiver

睡猫 2006-9-8 11:14

IBM Director < 5.10 (Redirect.bat) Directory Transversal Vulnerability

文章作者：Daniel Clemens

There is a vulnerability within the Redirect.bat file on a ibm director
cgi which allows a directory transversal to take place which in turn
exposes most files on the system to be read without authorization.

[url]http://ip.of.system:411/cgi-bin/Redirect.bat?file=%7C..[/url]\..\..\..\..\..\....\..\program%20files\ibm\director\version.key (or insert evil file here)


This was fixed in the 5.10 version of ibm director.

-Daniel Clemens

页: [1]
© 1999-2008 EvilOctal Security Team