Exploit RiSearch 0.99 /RiSearch Pro 3.2.6 - show.pl Arbitrary File Access

[Exploiter]

EDB-ID

24327

Проверка EDB

1. Пройдено

Автор

PHIL ROBINSON

Тип уязвимости

REMOTE

Платформа

CGI

CVE

cve-2004-2061

Дата публикации

2004-07-27

RiSearch 0.99 /RiSearch Pro 3.2.6 - show.pl Arbitrary File Access

source: https://www.securityfocus.com/bid/10812/info
 
RiSearch and RiSearch Pro are reported prone to an open proxy vulnerability. It is reported that the issue presents itself due to a lack of sufficient sanitization performed on user supplied URI parameters.
 
A remote attacker may exploit this condition in order to launch attacks against local and public services in the context of the site that is hosting the vulnerable script.

http://www.example.com/cgi-bin/search/show.pl?url=file:/etc/passwd