No description provided by source.
source: http://www.securityfocus.com/bid/230/info The File System Object (FSO) may be called from an Active Server Page (ASP) to display files that exist outside of the web server's root directory. FSO allows calls to be made utilizing "../" to exit the local directory path. An example of this syntax would be: http://www.server.foo/showfile.asp?file=../../global.asa This vulnerability could be used to view the source code of ASP files or stream data into other ASP files on the web server. <% ' grab the file from the URL FileName = Request.QueryString("file") ' create the filesystemobject and open the file Set fso = CreateObject("Scripting.FileSystemObject") Set ts = fso.OpenTextFile(Server.MapPath(FileName)) ' read the contents ShowTheFreakinThing = ts.ReadAll ' display them Response.Write ShowTheFreakinThing ' EOF %>