vendor:
AutoIndex PHP Script
by:
./Red-D3v1L
7,5
CVSS
HIGH
Directory Traversal
22
CWE
Product Name: AutoIndex PHP Script
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2018
AutoIndex PHP Script (index.php) Directory Traversal Vulnerability
AutoIndex PHP Script is vulnerable to directory traversal attack which allows an attacker to read arbitrary files and directories stored on the web server. This vulnerability is due to insufficient sanitization of user-supplied input to the 'dir' and 'file' parameters of the 'index.php' script. An attacker can exploit this vulnerability by sending a specially crafted HTTP request containing directory traversal sequences (e.g. '../') to the vulnerable script. Successful exploitation of this vulnerability may allow an attacker to read arbitrary files and directories stored on the web server.
Mitigation:
Input validation should be performed to ensure that user-supplied input is properly sanitized. It is recommended to restrict access to the vulnerable script.
