Sambar Server 5.1 - Script Source Disclosure

Author: pgrundl
type: remote
platform: cgi
port: 
date_added: 2002-04-17  
date_updated: 2012-09-19  
verified: 1  
codes: CVE-2002-0737;OSVDB-5122  
tags:   
aliases:   
screenshot_url:   
application_url:   

raw file: 21390.txt  

source: https://www.securityfocus.com/bid/4533/info

An issue has been discovered in Sambar Server, which could allow a user to reveal the source code of script files.

Submitting a request for a known script file along with a space and null character (%00), will successfully bypass the serverside URL parsing.

http://server/cgi-bin/environ.pl+%00