source: http://www.securityfocus.com/bid/3028/info Interactive Story is a web-based application written in Perl and is distributed as freeware. Interactive Story does not filter '../' sequences from user input submitted to a hidden file called 'next'. Remote attackers may take advantage of this by crafting URLs that allow them to break out of webroot and view arbitrary web-readable files. The disclosed information may be used in further attacks on the host. If an attacker sets the "next" field to something like ../../../../../../../../../../etc/passwd%00, Interactive Story will open and display the password file.
Related Exploits
Trying to match CVEs (1): CVE-2001-0804Trying to match OSVDBs (1): 683
Other Possible E-DB Search Terms: Interactive story 1.3, Interactive story
Date | D | V | Title | Author | No matches |
---|