Description
Directory traversal vulnerability in the IM Server (aka IMserve or IMserver) in Ipswitch Instant Messaging (IM) 2.0.8.1 and earlier allows remote authenticated users to create arbitrary empty files via a .. (dot dot) in the recipient field.
References
- http://aluigi.altervista.org/adv/ipsimene-adv.txt
- 20080207 Multiple vulnerabilities in Ipswitch Instant Messaging 2.0.8.1 mailing-list
- 27677 vdb-entry
- 3697 third-party-advisory
- http://aluigi.org/poc/ipsimene.zip