SurgeLDAP 1.0 - 'User.cgi' Directory Traversal

Author: dr_insane
type: remote
platform: cgi
port: 
date_added: 2004-04-12 
date_updated: 2013-01-09 
verified: 1 
codes: CVE-2004-2253;OSVDB-5169 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/10103/info

SurgeLDAP is prone to a directory traversal vulnerability in one of the scripts included with the built-in web administrative server, potentially resulting in disclosure of files.

A remote attacker could exploit this issue to gain access to system files outside of the web root directory of the built-in web server. Files that are readable by the web server could be disclosed via this issue.

http://www.example.com:6680/user.cgi?cmd=show&page=/../../../boot.ini