Home page logo
/

bugtraq logo Bugtraq mailing list archives

Viewing arbitrary file from the file system using Eshare Expressions 4 server
From: "Alex Forkosh" <aforkosh () techie com>
Date: Tue, 5 Feb 2002 00:18:42 -0600

There is a bug in Expressions server where you can view any file on the
drive that the server is installed on by using simple ../../

Example:
If eshare server Is installed at:
C:\eshare\expressions
And lets say this is an NT4.0 machine with os installed in c:\winnt
It is possible to pull win.ini file from winnt directory using 

Proto://domainname.com/../../../../../winnt/win.ini

Any file can be viewed in the manner.



  By Date           By Thread  

Current thread:
  • Viewing arbitrary file from the file system using Eshare Expressions 4 server Alex Forkosh (Feb 05)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]