PerlCal Filesystem Traversal Vulnerability

vendor:

PerlCal

by:

SecurityFocus

7.5

CVSS

HIGH

Filesystem Traversal

CWE

Product Name: PerlCal

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: N/A

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2002

PerlCal Filesystem Traversal Vulnerability

PerlCal is a CGI script written by Acme Software that allows web-based calendar sharing and related functions. A vulnerability exists in PerlCal which can allow a remote user to traverse the filesystem of a target host. This may lead to the disclosure of potentially sensitive file contents. Files and directories can be accessed through the use of double dot '../' techniques along with a relative path to the known resource. Disclosed content is dependant on the privilege level of the user the server is running under, typically user 'nobody'. This attack may lead to the disclosure of sensitive information and may aid in the assistance of future attacks.

Mitigation:

Ensure that the web server user has the least privileges necessary to access the files and directories required for the application to function.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/2663/info

PerlCal is a CGI script written by Acme Software that allows web-based calendar sharing and related functions.

A vulnerability exists in PerlCal which can allow a remote user to traverse the filesystem of a target host. This may lead to the disclosure of potentially sensitive file contents.

Files and directories can be accessed through the use of double dot '../' techniques along with a relative path to the known resource.

Disclosed content is dependant on the privilege level of the user the server is running under, typically user 'nobody'.

This attack may lead to the disclosure of sensitive information and may aid in the assistance of future attacks. 

http://www.example.com/cgi-bin/cal_make.pl?p0=../../../../../../../../../../../../etc/passwd%00

This will display the /etc/passwd (if the webserver user has
access to this file).