medium5.0Public exploit code
CVE-2004-0303
OWLS 1.0 allows remote attackers to retrieve arbitrary files via absolute pathnames in (1) the file parameter in /glossaries/index.php, (2) the filename parame…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Fool's Workshop Owl's Workshop 1.0 - 'resultsignore.php' Arbitrary File Access2004-02-18 · webapps · php · Verified
- Fool's Workshop Owl's Workshop 1.0 - 'readings/index.php' Arbitrary File Access2004-02-18 · webapps · php · Verified
- Fool's Workshop Owl's Workshop 1.0 - '/glossaries/index.php?File' Arbitrary File Access2004-02-18 · webapps · php · Verified
Impact
OWLS 1.0 allows remote attackers to retrieve arbitrary files via absolute pathnames in (1) the file parameter in /glossaries/index.php, (2) the filename parameter in /readings/index.php, or (3) the filename parameter in /multiplechoice/resultsignore.php, as demonstrated using /etc/passwd.
Affected packages
This record carries no package version data, so it cannot be matched against a dependency list automatically. Read the advisory and compare your version by hand.
References
- NVD record
- CVE.org record
- http://marc.info/?l=bugtraq&m=107712123305706&w=2
- http://www.securityfocus.com/bid/9689
- http://www.zone-h.org/en/advisories/read/id=3973/
- https://exchange.xforce.ibmcloud.com/vulnerabilities/15249
- http://marc.info/?l=bugtraq&m=107712123305706&w=2
- http://www.securityfocus.com/bid/9689
- http://www.zone-h.org/en/advisories/read/id=3973/
- https://exchange.xforce.ibmcloud.com/vulnerabilities/15249