Net.Data is a full-featured scripting language for creating powerful Web applications. Net.Data can access data from the most prevalent databases in the industry: DB2, Oracle, DRDA-enabled data sources, ODBC data sources, as well as flat file and web registry data. A security vulnerability in the product allows remote attackers to gain knowledge of the directory structure of a remote server.
Credit:
The information has been provided by Chad Kalmes.
When IBM's Net.Data is fed with improper requests, it will return the true directory path used by the server.
Example (from IBM's own pages):
By issuing a /report request from the document.d2w file, the db2www package builds and displays the proper HTML page, as requested.
However, by issuing a bad /show request (or /garbarge, etc.), the package outputs an error message showing the local path to the d2w macro file, assuming no valid /show function exists within the .d2w file.
