vendor:
Portix-CMS
by:
Or4nG.M4n
7.5
CVSS
HIGH
Local File Inclusion
22
CWE
Product Name: Portix-CMS
Affected Version From: v1.5.0. rc5
Affected Version To: v1.5.0. rc5
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: Windows 8
n/a
Portix-CMS 1.5.0. rc5 Local File Inclusion
Portix-CMS 1.5.0. rc5 is vulnerable to Local File Inclusion (LFI) attacks. An attacker can exploit this vulnerability by sending a crafted HTTP request containing directory traversal sequences and file names to the vulnerable server. This will allow the attacker to read sensitive files from the server, such as configuration files, source code, etc. The vulnerable URL is http://<=- Domain -=>/<=- Path -=>/print.php?page=../../../../../../../../../../[LFI].
Mitigation:
To mitigate this vulnerability, the application should be configured to only allow access to files that are necessary for the application to function. Additionally, the application should be configured to only allow access to files that are located within the application's directory structure.
