vendor:
Auktion
by:
SecurityFocus
7.5
CVSS
HIGH
Remote File Access
22
CWE
Product Name: Auktion
Affected Version From: 1.62
Affected Version To: 1.62
Patch Exists: NO
Related CWE: N/A
CPE: HIS Software Auktion
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2002
HIS Software Auktion 1.62 Remote File Access Vulnerability
A remote user could gain read access to known files outside of the root directory where HIS Software Auktion 1.62 resides. Requesting a specially crafted URL composed of '../' sequences along with the known filename will disclose the requested file. This vulnerability could also lead to the execution of arbitrary code.
Mitigation:
Ensure that the application is not vulnerable to directory traversal attacks by validating user input and restricting access to sensitive files.
