Description
The HTTP service in EServ/3 3.25 allows remote attackers to obtain sensitive information via crafted HTTP requests containing dot, space, and slash characters, which reveals the source code of script files.
References
- 20059 third-party-advisory
- 1006 third-party-advisory
- http://secunia.com/secunia_research/2006-37/advisory/
- eserv-file-extension-source-code-disclosure(26741) vdb-entry
- ADV-2006-2066 vdb-entry
- 18179 vdb-entry
- 20060531 Secunia Research: Eserv/3 IMAP and HTTP Server MultipleVulnerabilities mailing-list
- http://www.eserv.ru/ru/news/news_detail.php?ID=235