ImgSvr is "a personal or corporate Embedded Picture Web Server that let's you efficiently browse digital pictures. Contrary to other gallery systems, imgsvr aimed to be an easy and fully dynamic picture server, no static created thumbnails are created." A directory traversal vulnerability can be exploited in ImgSvr through the usage of additional chars before the URI.
Vulnerable Systems:
* Ada Image Server version 0.6.21
In Luigi's tests any byte except NULL, line feed, ?, :, slash and backslash (so an amount of valid chars between 248 and 251 depending by the location of the char and if has been used the hex format), can be used to trigger the directory traversal vulnerability.
A secondary type of directory traversal is exploitable through the template parameter.
If the root directory of the server is protected by authentication, the attacker must know the right username and password.
Exploit:
Any of the following can be used to trigger the vulnerability: GET hello../../../../../boot.ini HTTP/1.0
GET anything_you_want../..%2f../%2e.%5c..%5cboot.ini HTTP/1.0
