header-logo
Suggest Exploit
vendor:
Web+
by:
SecurityFocus
7.5
CVSS
HIGH
Information Disclosure
200
CWE
Product Name: Web+
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2002

Talentsoft Web+ Internal IP Disclosure Vulnerability

Talentsoft Web+ is a web application server that can be integrated with various web technologies. A vulnerability exists in one of the CGI applications implemented by Web+. It is possible for a remote user to retrieve the internal IP address in a NAT environment running Web+ by requesting a specially crafted URL containing the 'about' argument.

Mitigation:

Ensure that the web application is configured to prevent the disclosure of sensitive information.
Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/1720/info

Talentsoft Web+ is a web application server that can be integrated with various web technologies.

A vulnerability exists in one of the CGI applications implemented by Web+. It is possible for a remote user to retrieve the internal IP address in a NAT environment running Web+. Requesting a specially crafted URL containing the 'about' argument will disclose the internal IP address behind the NAT.

Successful exploitation of this vulnerability could aid in further and more complicated attacks against the target site. 

http://target/cgi-bin/webplus.exe?about

Navigation

Suggest Exploit

Services By CQR