vendor:
Powersoft
by:
james fitts
N/A
CVSS
N/A
Directory Traversal
22
CWE
Product Name: Powersoft
Affected Version From: 2.1.1.1
Affected Version To: 2.1.1.1
Patch Exists: N/A
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2015
Carlo Gavazzi Powersoft Directory Traversal
This module exploits a directory traversal vulnerability found in Carlo Gavazzi Powersoft <= 2.1.1.1. The vulnerability is triggered when sending a specially crafted GET request to the server. The location parameter of the GET request is not sanitized and the sendCommand.php script will automatically pull down any file requested.
Mitigation:
Input validation should be used to prevent directory traversal attacks.
