Lucene search
WebCom datakommunikation Guestbook 0.1 - 'wguest.exe' Arbitrary File Access
Show more
| Reporter | Title | Published | Views | Family All 7 |
|---|---|---|---|---|
 | WebCom datakommunikation Guestbook 0.1 - 'rguest.exe' Arbitrary File Access | 9 Apr 199900:00 | – | exploitdb |
 | CVE-1999-0467 | 4 Feb 200005:00 | – | cve |
| CVE-1999-0287 | 4 Feb 200005:00 | – | cve |
 | CVE-1999-0467 | 1 Apr 199905:00 | – | nvd |
| CVE-1999-0287 | 9 Apr 199904:00 | – | nvd |
 | CVE-1999-0467 | 4 Feb 200005:00 | – | cvelist |
| CVE-1999-0287 | 4 Feb 200005:00 | – | cvelist |
source: https://www.securityfocus.com/bid/2024/info
The freeware guestbook package from freeware.webcom.se provides a web-based guestbook feature, using CGI. Some versions of this guestbook (undetermined at the time of writing) are vulnerable to an attack allowing an intruder to retrieve the contents of arbitrary files to which the web server has access. This can be accomplished by specifying the path and filename as the parameter "template" to either rguest.exe or wguest.exe - see Exploit for example. These two programs typically reside in /cgi-bin.
A request for http://server/cgi-bin/wguest.exe?template=c:\boot.ini will return the remote Web server's boot.iniTransform Your Security Services
Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.
Book a live demo09 Apr 1999 00:00Current
7.4High risk
Vulners AI Score7.4