[Full-disclosure] Blizzard.com - Information disclosure.

[kefka]

Blizzard.com fails to properly sanitize user-supplied input resulting in 
information disclosure:
http://www.blizzard.com/wow/ssotd/screenshot.aspx?imageindex=1027&Set=%00

Note the fact that their webroot is on the C: partition.
"C:\web\blizzard.com\wow\ssotd\screenshot.aspx"
*Version Information:* Microsoft .NET Framework Version:1.1.4322.2032; 
ASP.NET Version:1.1.4322.2032 <-- lol (outdated/missing a hotfix or two)

http://www.blizzard.com/wow/ssotd/screenshot.aspx?imageindex=1027'&Set=0 
<--- probably vulnerable to SQL injection but I don't want to try it.
http://www.blizzard.com/wow/ssotd/screenshot.aspx?imageindex=1027&Set=0 
<--- should recieve this image, not the first image...meaning something 
is happening to the query