PT-2019-13103 · Sahi · Sahi Pro

Operat0R · Publicado 2019-09-23 · Atualizado 2019-09-23 · CVE-2019-13063

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Sahi Pro version 8.0.0

Description The issue allows an attacker to send a specially crafted URL to disclose files on the system via the script parameter on the "Script view" page. This results in file disclosure, enabling the attacker to obtain sensitive configuration and other files, potentially leading to complete application compromise. The script parameter is vulnerable to directory traversal and both local and remote file inclusion.

Recommendations For Sahi Pro version 8.0.0, as a temporary workaround, consider restricting access to the "Script view" page and limiting the use of the script parameter to minimize the risk of exploitation. Avoid using the script parameter in the affected page until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2019-13063

Produtos afetados

Sahi Pro

Referências · 4

• 🔥 https://exploit-db.com/exploits/47062 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-13063 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-13063 · Aviso do Fabricante
• https://sahipro.com/downloads-archive · Aviso do Fabricante