header-logo
Suggest Exploit
vendor:
My Postcards
by:
SecurityFocus
7.5
CVSS
HIGH
File Disclosure
200
CWE
Product Name: My Postcards
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: Yes
Related CWE: N/A
CPE: N/A
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: Unix and Linux
2002

My Postcards File Disclosure Vulnerability

My Postcards is a commercial available eletronic postcard system. It is available for Unix and Linux Operating Systems. The magiccard.cgi script does not properly handle some types of input. As a result, it may be possible for a remote user to specify the location of a specific file on the system hosting the My Postcards software. Upon specifying the location of a file that is readable by the web server process, the user could disclose the contents of the specified file.

Mitigation:

Ensure that the magiccard.cgi script is properly configured to handle user input.
Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/5029/info

My Postcards is a commercial available eletronic postcard system. It is available for Unix and Linux Operating Systems.

The magiccard.cgi script does not properly handle some types of input. As a result, it may be possible for a remote user to specify the location of a specific file on the system hosting the My Postcards software. Upon specifying the location of a file that is readable by the web server process, the user could disclose the contents of the specified file. 

http://www.example.com/cgi-bin/magiccard.cgi?pa=preview&next=custom&page=../../../../../../../../../../etc/passwd

Navigation

Suggest Exploit

Services By CQR