http commander 4.0 - Directory Traversal

Author: Zero X
type: webapps
platform: asp
port: 
date_added: 2003-11-01 
date_updated: 2012-12-12 
verified: 1 
codes: CVE-2003-1166;OSVDB-2780 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/8948/info

It has been reported that HTTP Commander is prone a directory traversal issue allowing a remote attacker to traverse outside the server root directory by using '../' character sequences.

Successful exploitation of this vulnerability may allow a remote attacker to gain access to sensitive information, which may be used to mount further attacks against a vulnerable system.

HTTP Commander version 4.0 is reported to be prone to this issue, however other versions may be affected as well.

http://www.example.com/NetDemo2/OpenFile.aspx?file=../../../../../../../../boot.ini

http://www.example.com/NetDemo2/html.aspx?file=../../../../../../../../../boot.ini