Security Advisory 05 – 004 – Source Code Disclosure
Vulnerability discovery and development:
Portcullis Security Testing Services
Emotion MediaPartner Web Server Version 5.0 and 5.1
By appending a period (‘.’) or a plus-sign (‘+’) to a request for a .bhtml file, the source of the .bhtml file is returned rather than .executed.
Allows an attacker to determine how the application works and can aid in further attacks. Note this vulnerability was used to discover “Password Update Process Flaw” vulnerability.
No exploit code required.