Drummond Miles A1Stats 1.0 a1disp3.cgi Traversal Arbitrary File Read

ID EDB-ID:20832
Type exploitdb
Reporter neme-dhc
Modified 2001-05-07T00:00:00


Drummond Miles A1Stats 1.0 a1disp3.cgi Traversal Arbitrary File Read. CVE-2001-0561. Remote exploit for cgi platform

                                            source: http://www.securityfocus.com/bid/2705/info
A1Stats is a CGI product by Drummon Miles used to report on a website's visitor traffic.
Versions of this product fail to properly validate user-supplied input submitted as querystrings to the A1Stats script.
An attacker can compose a long path including '/../' sequences, and submit it as a file request to the product's built-in webserver. 'dot dot' sequences will not be filtered from the path, permitting the attacker to specify files outside the directory tree normally available to users.
This can permit disclosure of confidential data and sensitive system files which, if properly exploited, could lead to further compromises of the host's security.
Additionally, by appending a properly formatted echo command argumented by a filename writable by the webserver, this flaw allows the attacker to overwrite this file with A1Stats' output.