HTTP Commander Directory Traversal Vulnerability

vendor:

HTTP Commander

by:

SecurityFocus

4.3

CVSS

MEDIUM

Directory Traversal

CWE

Product Name: HTTP Commander

Affected Version From: 4

Affected Version To: 4

Patch Exists: NO

Related CWE: N/A

CPE: a:http_commander:http_commander

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2003

HTTP Commander Directory Traversal Vulnerability

HTTP Commander is prone to a directory traversal vulnerability, which allows a remote attacker to traverse outside the server root directory by using '../' character sequences. Successful exploitation of this vulnerability may allow a remote attacker to gain access to sensitive information, which may be used to mount further attacks against a vulnerable system. HTTP Commander version 4.0 is reported to be prone to this issue, however other versions may be affected as well.

Mitigation:

Ensure that user-supplied input is properly sanitized and validated before being used in a filesystem operation.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/8948/info

It has been reported that HTTP Commander is prone a directory traversal issue allowing a remote attacker to traverse outside the server root directory by using '../' character sequences.

Successful exploitation of this vulnerability may allow a remote attacker to gain access to sensitive information, which may be used to mount further attacks against a vulnerable system.

HTTP Commander version 4.0 is reported to be prone to this issue, however other versions may be affected as well.

http://www.example.com/NetDemo2/OpenFile.aspx?file=../../../../../../../../boot.ini

http://www.example.com/NetDemo2/html.aspx?file=../../../../../../../../../boot.ini