medium5.0Public exploit code
CVE-2004-1678
Directory traversal vulnerability in pdesk.cgi in PerlDesk allows remote attackers to read portions of arbitrary files and possibly execute arbitrary Perl modu…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- PerlDesk Language Variable - Server-Side Script Execution2004-09-13 · webapps · cgi · Verified
Impact
Directory traversal vulnerability in pdesk.cgi in PerlDesk allows remote attackers to read portions of arbitrary files and possibly execute arbitrary Perl modules via ".." sequences terminated by a %00 (null) character in the lang parameter, which can leak portions of the requested files if a compilation error message occurs.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Logicnow | Perldesk | All versions |
References
- NVD record
- CVE.org record
- http://marc.info/?l=bugtraq&m=109509026406554&w=2
- http://secunia.com/advisories/12512
- http://www.securityfocus.com/bid/11160
- https://exchange.xforce.ibmcloud.com/vulnerabilities/19712
- http://marc.info/?l=bugtraq&m=109509026406554&w=2
- http://secunia.com/advisories/12512
- http://www.securityfocus.com/bid/11160
- https://exchange.xforce.ibmcloud.com/vulnerabilities/19712