Key Focus KF Web Server 1.0.2 - Directory Contents Disclosure

Author: Securiteinfo.com
type: remote
platform: windows
port: 
date_added: 2002-07-08 
date_updated: 2012-09-29 
verified: 1 
codes: CVE-2002-1031;OSVDB-5026 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/5177/info

It has been reported that version 1.0.2 of KF Web Server discloses the contents of directories when a certain character is present in the URL.

If a remote attacker appends the "%00" character, it will cause the web server to display the contents of the current directory.

http://server_name/subdir/%00
http://server_name/%00