header-logo
Suggest Exploit
vendor:
EServ
by:
SecurityFocus
3,3
CVSS
MEDIUM
Password Protected File Access
200
CWE
Product Name: EServ
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: Windows 9x/NT/2000
2002

EServ Password Protected File Access Vulnerability

EServ is a combination Mail, News, Web, FTP and Proxy Server for Microsoft Windows 9x/NT/2000 systems. It is possible to construct a web request which is capable of accessing the contents of password protected files/folders on the webserver, such as the admin folder, which contains the administrative interface. It should be noted that this vulnerability may only be exploited to access password-protected files in sub-folders of wwwroot. The following example will give the attacker access to the administrative interface: http://host/./admin/default.htm

Mitigation:

Ensure that all password-protected files are stored outside of the wwwroot folder.
Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/3838/info

EServ is a combination Mail, News, Web, FTP and Proxy Server for Microsoft Windows 9x/NT/2000 systems.

It is possible to construct a web request which is capable of accessing the contents of password protected files/folders on the webserver, such as the admin folder, which contains the administrative interface.

It should be noted that this vulnerability may only be exploited to access password-protected files in sub-folders of wwwroot. 

The following example will give the attacker access to the administrative interface:

http://host/./admin/

Navigation

Suggest Exploit

Services By CQR