EUVD-2010-2097

Malware in sbrugna...

Design/Logic Flaw

DataTrack System 3.5 allows remote attackers to bypass intended restrictions on file extensions, and read arbitrary files, via a trailing backslash in a URI, as demonstrated by 1 web.config\ and 2 .ascx\ files...

Design/Logic Flaw

DataTrack System 3.5 allows remote attackers to list the root directory via a 1 /%u0085/ or 2 /%u00A0/ URI...

DataTrack System 3.5 Cross Site Scripting

============================================================================================================ //\ /\ /\ /\ /\ /\ ///\ //\ /\ /\///\ // \ // //\ \ / //\ \ / // //\ \ /\\ \ \ \ / / / / // \ \ // // // // \ // //\ \\ \ // /// \ \ / \ / // / // / / / / / \ \ / / / ...