CVE-2000-0686

Description

Auction Weaver CGI script 1.03 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) attack in the fromfile parameter.

Affected products

• cgi_script_center / auction_weaver1.02

References

• MISChttp://www.securityfocus.com/bid/1630
• MISChttp://archives.neohapsis.com/archives/bugtraq/2000-08/0310.html