|
|
|
|
| |
| A double dot vulnerability exists on sites running Informix databases. A remote attacker can read any local file on the system by putting /../ into accessed URLs. This could reveal sensitive information on the remote host that could lead to a system wide compromise. |
| |
Credit:
The information has been provided by Beck Mr.R.
|
| |
By default, all images are linked using such URLs as this:
http://example.com/ifx/?LO=00000001a6b7c8d900000003000000030004334d38e02543000000000001
eb80000000000000000000000000000000000000000000000000000000000000000000000000000
00000
This URL fetches an image from the wbBinaries system table. The Web DataBlade Module provides wbBinaries the storing capabilities of large binary resources such as images, sounds, and videos.
However, we can get the content of /etc directory by accessing the following URL:
http://example.com/ifx/?LO=../../../etc/
Alternatively, the content of file the file /etc/passwd:
http://example.com/ifx/?LO=../../../etc/passwd
|
|
|
|
|
|
|
|
|
|
