Reported December 7, 2000 by SNS Research
- HomeSeer v1.4.15
The Web server component of the HomeSeer software for X10 technology lets users traverse directories outside of the Web publishing directory. The problem stems from improperly-parsed directives (..\).
DEMONSTRATION
http://localhost:80/../../../autoexec.bat
VENDOR RESPONSE
Keware is aware of the problem and released an updated beta version 1.5.29 available at http://www.keware.com/kewarebeta.htm
CREDIT
Discovered by SNS Research
0 comments
Hide comments
