Technote Inc Technote 'filename' Parameter Command Execution And File Disclosure Vulnerability
Technote Inc. offers a multi-communication Package that includes a web board type of service.
A script that ships with Technote, 'main.cgi', accepts a parameter called 'filename'. This remotely supplied variable is used as a filename when the open() function is called. In addition to allowing the attacker to specify a file to be opened remotely, the variable is not checked for '../' character sequences. As a result, a malicious remote user can specify any file on the file system as this variable (by using ../ sequences followed by its real path), which will be opened by the script. Its contents will then be disclosed to the attacker.
It is reported that this issue could be leveraged to execute arbitrary commands on the affected computer as well. This issue is due to a failure of the application to properly sanitize the offending URI parameter.
Successful exploitation of this vulnerability could lead to the disclosure of sensitive information and arbitrary system command execution, possibly assisting in further attacks against the affected computer.
Udate: This vulnerability has been updated; previously it was classified strictly as a file disclosure vulnerability. New information has become available that suggests that this issue may be leveraged to execute arbitrary commands on the affected computer as well.