EServ 2.9x - Password-Protected File Access

ID EXPLOITPACK:3980A27254927CEFB1982F17742B6301
Type exploitpack
Reporter Tamer Sahin
Modified 2002-01-10T00:00:00


EServ 2.9x - Password-Protected File Access


EServ is a combination Mail, News, Web, FTP and Proxy Server for Microsoft Windows 9x/NT/2000 systems.

It is possible to construct a web request which is capable of accessing the contents of password protected files/folders on the webserver, such as the admin folder, which contains the administrative interface.

It should be noted that this vulnerability may only be exploited to access password-protected files in sub-folders of wwwroot. 

The following example will give the attacker access to the administrative interface: