HC's Capture the Flag website
CTF Contests
25C3-CTF
25C3-CTF final results
Advisory #109
From team WiiPhonies
New advisory by : c1de0x
Affected service(s): CGIBAS
Severity [lmh] : high
===== Problem =====
The existing fix for the directory traversal in download.bas doesn't fix absolute access.
===== Impact =====
Read any system files.
===== Fix =====
Prepend ./ to all file names:
1923 let gimme="./"; gimme
2000 open gimme for input as #2
Rating
[1] nice :-))