Per CVE-2002-1603: GoAhead Web Server 2.1.7 and earlier allows remote attackers to obtain the source code of ASP files via a URL terminated with a /, \, %2f (encoded /), %20 (encoded space), or %00 (encoded null) character, which returns the ASP source code unparsed.

Foo WebServer turns up in a number of interesting places, like S2 and Linear eMerge door access systems and Rockwell Automation AB ControlLogix controllers.

Graph linking

CVE-2002-1603 (last edited 2010-01-21 20:35:37 by kcc7d6a)