Detections
Analytics
Kebi Academy Home Page Administration file Parameter Traversal Arbitrary File Access
high Nessus Plugin ID 11453
Language:
Synopsis
The remote web server contains a CGI script that is susceptible to a directory traversal attack.Description
Kebi Academy, a Korean web application, fails to sanitize user input to the 'file' parameter to the 'home' script of directory traversal sequences. A remote attacker can leverage this issue to read arbitrary files or even upload arbitrary code to the affected host, to be executed subject to the privileges under which the web server operates.Solution
Contact the vendor for an update.See Also
Plugin Details
Severity: High
ID: 11453
File Name: kebi_traversal.nasl
Version: 1.21
Type: remote
Family: CGI abuses
Published: 3/24/2003
Updated: 1/19/2021
Supported Sensors: Nessus
Vulnerability Information
Excluded KB Items: Settings/disable_cgi_scanning
Exploit Available: true
Exploit Ease: No exploit is required
Vulnerability Publication Date: 3/17/2003
Reference Information
BID: 7125