CVE-2004-2526

IBM Tivoli Directory Server <4.1 - Path Traversal

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2004-2526. PoCs published by anonymous.

AI-analyzed exploit summary This exploit demonstrates a directory traversal vulnerability in IBM Tivoli Directory Server's web front-end. By manipulating the 'Template' parameter, an attacker can access sensitive files on the server, such as 'boot.ini', with the privileges of the 'ldap' user.

Description

Directory traversal vulnerability in ldacgi.exe in IBM Tivoli Directory Server 4.1 and earlier allows remote attackers to view arbitrary files via a .. (dot dot) in the Template parameter.

Exploits (1)

exploitdb WORKING POC VERIFIED

by anonymous · textremotewindows

https://www.exploit-db.com/exploits/24345

View Code ZIP pw:eip

This exploit demonstrates a directory traversal vulnerability in IBM Tivoli Directory Server's web front-end. By manipulating the 'Template' parameter, an attacker can access sensitive files on the server, such as 'boot.ini', with the privileges of the 'ldap' user.

Classification

Working Poc 90%

Attack Type

Info Leak

Complexity

Trivial

Reliability

Reliable

Target: IBM Tivoli Directory Server 3.2.2, 4.1

No auth needed

Prerequisites: Network access to the vulnerable IBM Tivoli Directory Server web front-end

MITRE ATT&CK