By modifying the GroupWise Web Interface HELP URL request, it is possible to gain additional information on the remote computer and even read local files from its hard drive.
Credit:
The information was provided by Laurent Hollo and Sacha Faust Bourque.
The following vulnerabilities are present in the GroupWise Web Interface:
1. The help argument in GWWEB.EXE can be used to reveal the full web path on the server.
2. Anyone can read an .htm file on the system with the GWWEB.EXE and the HELP argument.
Example:
1. By sending http://server/cgi-bin/GW5/GWWEB.EXE?HELP=bad-request the server will reply: Could not find file SYS:WEB\CGI-BIN\GW5\US\HTML3\HELP\BAD-REQUEST.HTM
2. By sending http://server/cgi-bin/GW5/GWWEB.EXE?HELP=../../../../../index (referring to the path returned in the previous example) you will see the main web site interface.
