Secunia

Recently, a directory traversal vulnerability was discovered in iWeb Mini Web Server. The vendor fixed this by issuing a new version, but the vulnerability was not fixed properly.

A malicious person may still conduct a directory traversal attack by supplying the URL encoded values for "..\" in a HTTP request to the web server.

Example:
http://[victim]/%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5cwindows\system.ini

The vulnerability has been confirmed in version 2.0.1.4.

Previous advisory:
http://secunia.com/advisories/8599/

Solution
A new version has not been released at present.
Further details available in Customer Area

Provided and/or discovered by
posidron

Deep Links
Links available in Customer Area