NaviCOPA Script Source Disclosure Vulnerability
SECUNIA ADVISORY ID: SA37014
VERIFY ADVISORY: http://secunia.com/advisories/37014/
DESCRIPTION: Dr_IDE has discovered a vulnerability in NaviCOPA, which can be exploited by malicious people to disclose potentially sensitive information.
The vulnerability is caused due to an error within the handling of HTTP requests and can be exploited to disclose the source code of certain scripts (e.g. PHP) by appending “%20″ to the URI.
The vulnerability is confirmed in version 3.01.2. Other versions may also be affected.
SOLUTION: Restrict access to trusted users only.
PROVIDED AND/OR DISCOVERED BY: Dr_IDE
ORIGINAL ADVISORY: http://pocoftheday.blogspot.com/2009/10/navicopa-web-server-3012-remote-source.html
———————————————————————-