|
Brought to you by:
Suppliers of:
|
|
|
| |
"Web Forum & File Sharing Server is a Windows 2000/XP program that allows you to setup a bulletin board system and photo/file exchange web service."
Multiple Vulnerabilities in Web Forums Server allow an attacker to read arbitrary files, and read all (cleartext) user passwords. |
| |
Credit:
The information has been provided by R00tCr4ck.
|
| |
Directory Traversal Vulnerability:
There is directory traversal vulnerability in Web Forums Server that may allow a remote attacker to view files residing outside of the web server root directory.
Examples:
http://[victim]/..\..\..\file.ext
http://[victim]/../../../file.ext
or as encoded format:
http://[victim]/%2E%2E%5C%2E%2E%5C%2E%2E%5Cfile.ext
http://[victim]/%2E%2E%2F%2E%2E%2F%2E%2E%2Ffile.ext
Plaintext Password Vulnerability:
Web Forums Server stores all accounts with the passwords in plaintext using Username.ini file. This could lead to users gaining unauthorized access to passwords, and potentially unauthorized access to the Web Forums Server.
|
|
|
|
|
