CVE-2002-2416
published 2002-12-31CVE-2002-2416: Directory traversal vulnerability in Zeroo web server 1.5 allows remote attackers to read arbitrary files via a .. (dot dot) in a URL GET request.
PriorityP431medium5CVSS 2.0
AVNACLAuNCNIPAN
EXPLOIT
EPSS
6.03%
92.5th percentile
Directory traversal vulnerability in Zeroo web server 1.5 allows remote attackers to read arbitrary files via a .. (dot dot) in a URL GET request.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| zeroo | http_server | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Zeroo HTTP Server 1.5 - Directory Traversal (2)
exploitdb·2002-11-22
CVE-2002-2416 Zeroo HTTP Server 1.5 - Directory Traversal (2)
Zeroo HTTP Server 1.5 - Directory Traversal (2)
---
source: https://www.securityfocus.com/bid/6308/info
It has been reported that Zeroo fails to properly sanitize web requests. By sending a malicious web request to the vulnerable server, using directory traversal sequences, it is possible for a remote attacker to access sensitive resources located outside of the web root.
An attacker is able to traverse outside of the established web root by using dot-dot-slash (../) directory traversal sequences. An attacker may be able to obtain any web server readable files from outside of the web root directory.
#!/usr/bin/perl
use IO::Socket;
$pkt = "GET /../../../../../../../../../../../../../../../../../../../../%s
HTTP/1.0\r\n\r\n";
if (@ARGV 3) {
print STDOUT "Usage: perl $0 [filename] [host]
Exploit-DB
Zeroo HTTP Server 1.5 - Directory Traversal (1)
exploitdb·2002-11-22
CVE-2002-2416 Zeroo HTTP Server 1.5 - Directory Traversal (1)
Zeroo HTTP Server 1.5 - Directory Traversal (1)
---
// source: https://www.securityfocus.com/bid/6308/info
It has been reported that Zeroo fails to properly sanitize web requests. By sending a malicious web request to the vulnerable server, using directory traversal sequences, it is possible for a remote attacker to access sensitive resources located outside of the web root.
An attacker is able to traverse outside of the established web root by using dot-dot-slash (../) directory traversal sequences. An attacker may be able to obtain any web server readable files from outside of the web root directory.
/*
* zeroo httpd remote directory traversal exploit
* proof of concept
* hehe, just a copy and paste from my other directory
* traversal exploit ;p
* [mikecc] [http://uc.zemos.net/]
*/
No writeups or analysis indexed.
http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0083.htmlhttp://cert.uni-stuttgart.de/archive/bugtraq/2002/11/msg00306.htmlhttp://www.iss.net/security_center/static/10672.phphttp://www.securityfocus.com/bid/6308http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0083.htmlhttp://cert.uni-stuttgart.de/archive/bugtraq/2002/11/msg00306.htmlhttp://www.iss.net/security_center/static/10672.phphttp://www.securityfocus.com/bid/6308
2002-12-31
Published