mirror of
https://github.com/offensive-security/exploitdb.git
synced 2026-11-10 22:11:29 -10:00
7 lines
641 B
Plaintext
Executable File
7 lines
641 B
Plaintext
Executable File
source: http://www.securityfocus.com/bid/5035/info
|
|
|
|
Wolfram Research's webMathematica is a Java based product which allows the inclusion of Mathematica content in a web environment. It includes CGI programs which generate image content based on user supplied input.
|
|
|
|
A file disclosure vulnerability has been reported with the MSP CGI program. A file name parameter supplied by the user is not properly validated. The inclusion of "../" character sequences allows the attacker to escape the web root, and view arbitrary system files.
|
|
|
|
http://www.domain.com/webMathematica/MSP?MSPStoreID=../../../../../etc/passwd&MSPStoreType=image/gif |