ROADS search.pl form Parameter Traversal Arbitrary File Access

The 'search.pl' CGI from ROADS is installed. This CGI has a well known security flaw that lets an attacker read arbitrary files with the privileges of the HTTP daemon. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; ifdescription...

ROADS search system "show files" Vulnerability with "null bite" bug

Name: ROADS search system "show files" Vulnerability with "null bite" bug Date: 29.01.2001 About: The search.pl program is a Common Gateway Interface CGI program used to provide an end user search front end to ROADS databases. When accessed with no CGI query, the program can return an HTML form t...

Martin Hamilton ROADS 2.3 - File Disclosure

Martin Hamilton ROADS 2.3 - File Disclosure source: https://www.securityfocus.com/bid/2371/info A remote user could gain read access to known files outside of the root directory where Martin Hamilton ROADS resides. Requesting a specially crafted URL composed of '%00' sequences along with the know...