PT-2002-2328 · Goahead · Goahead Web Server

Published 2002-02-13 · Updated 2017-07-11 · CVE-2002-1603

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions GoAhead Web Server versions 2.1.7 and earlier

Description The issue allows remote attackers to obtain the source code of ASP files by appending specific characters to a URL, such as a /, ``, %2f (encoded /), %20 (encoded space), or %00 (encoded null) character. This results in the ASP source code being returned unparsed.

Recommendations For GoAhead Web Server versions 2.1.7 and earlier, update to a version later than 2.1.7 to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2002-1603

Affected Products

Goahead Web Server

References · 16

• 🔥 https://exploit-db.com/exploits/23446 · Exploit
• 🔥 http://securityfocus.com/bid/9239 · Exploit
• 🔥 http://aluigi.altervista.org/adv/goahead-adv3.txt · Exploit
• 🔥 http://securitytracker.com/id?1005820 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2002-1603 · Security Note
• http://osvdb.org/13295 · Note
• http://rockwellautomation.custhelp.com/cgi-bin/rockwellautomation.cfg/php/enduser/std_adp.php?p_faqid=57729 · Note
• http://procheckup.com/PDFs/ProCheckUp_Vulns_2002.pdf · Note
• http://data.goahead.com/Software/Webserver/2.1.8/release.htm#bug-with-urls-like-asp · Note
• http://kb.cert.org/vuls/id/124059 · Note
• http://kb.cert.org/vuls/id/RGII-7MWKZ3 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/10885 · Note
• http://secunia.com/advisories/7741 · Note
• http://procheckup.com/security_info/vuln_pr0213.html · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1603 · Note