Sambar Server 6.1 beta 2 showini.asp Arbitrary File Access

2004-06-01T00:00:00
ID EDB-ID:24163
Type exploitdb
Reporter Oliver Karow
Modified 2004-06-01T00:00:00

Description

Sambar Server 6.1 beta 2 showini.asp Arbitrary File Access. CVE-2004-2565. Remote exploit for windows platform

                                        
                                            source: http://www.securityfocus.com/bid/10444/info
  
Sambar Server is reportedly prone to multiple vulnerabilities. These issues may allow an attacker to access sensitive files and carry out directory traversal and cross-site scripting attacks.
  
These issues require an attacker to have administrative privileges, however, it is reported that an administrative password is not set on the server by default. An administrator who is not intended to have certain privileges may also exploit these vulnerabilities.
  
Sambar 6.1 Beta 2 is reported to be prone to these issues, however, it is likely that other versions are affected as well.

http://www.example.com/sysadmin/system/showini.asp?file=\..\..\..\..\..\..\..\boot.ini