Description
HTTP Proxy in Sambar Server before 6.0 beta 6, when security.ini lacks a 127.0.0.1 proxydeny entry, allows remote attackers to send proxy HTTP requests to the Sambar Server's administrative interface and external web servers, by making a "Connection: keep-alive" request before the proxy requests.
Exploits (1)
exploitdb
WORKING POC
VERIFIED
by David Endler · textremotewindows
https://www.exploit-db.com/exploits/24076
References (7)
Core 7
Core References
Vendor Advisory x_refsource_confirm
http://www.sambar.com/security.htm
Exploit, Patch vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/10256
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/16054
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/9578
Patch vdb-entry
x_refsource_sectrack
http://securitytracker.com/id?1007819
Vendor Advisory third-party-advisory
x_refsource_idefense
http://www.idefense.com/application/poi/display?id=103&type=vulnerabilities&flashstatus=true
Vendor Advisory mailing-list
x_refsource_bugtraq
http://archives.neohapsis.com/archives/bugtraq/2004-04/0353.html
Scores
EPSS
0.1110
EPSS Percentile
93.5%
Details
Status
published
Products (5)
sambar/sambar_server
5.0 (7 CPE variants)
sambar/sambar_server
5.1 (6 CPE variants)
sambar/sambar_server
5.2
sambar/sambar_server
5.3
sambar/sambar_server
6.0 beta1 (5 CPE variants)
Published
Dec 31, 2003
Tracked Since
Feb 18, 2026