• info
• discussion
• exploit
• solution
• references

Dino's Webserver Directory Traversal Vulnerability

Dino's Webserver 1.x is vulnerable to a directory traversal attack which could expose arbitrary files on the machine hosting the web server. This can be accomplished by specifying a relative path, for example "http://localhost/../../../../autoexec.bat". The web server must have read access to the file thus requested.