Bugtraq mailing list archives

MondoSearch show the source of all files


From: thefastkid <thefastkid () ziplip com>
Date: 10 Oct 2002 18:09:35 -0000



MondoSearch show the source of all files
--------------------------------------------

Affected Program: MondoSearch 4.4
(possibly earlier versions too, but not tested)
Vendor: http://www.mondosoft.com
Vendor Status: not informed yet
Discovery Date: 10 oct 2002

Problem
-------
You can see the source of the files, who are in the same
directory and subdirectories


Example
-------
http://www.foo/cgi-bin2/MsmMask.exe?mask=/
foo.asp ..to see the source of foo.asp in the root dir


Solutions
---------
* The program have to check if is real .cfg file


Current thread: