PT-2019-12749 · Deltek · Deltek Maconomy

Ras313 · Published 2019-05-24 · Updated 2019-11-05 · CVE-2019-12314

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Deltek Maconomy version 2.2.5

Description The issue allows for local file inclusion via absolute path traversal. This can be achieved through the "WS.macx1.W MCS/" endpoint in the PATH INFO, as demonstrated by accessing a "cgi-bin/Maconomy/MaconomyWS.macx1.W MCS/etc/passwd" URI.

Recommendations For Deltek Maconomy version 2.2.5, consider restricting access to the "WS.macx1.W MCS/" endpoint to minimize the risk of exploitation. Avoid using absolute paths in the PATH INFO to prevent traversal attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2019-12314

GHSA-8762-RF4G-23XM

Affected Products

Deltek Maconomy

References · 6

• 🔥 https://github.com/JameelNabbo/exploits/blob/master/Maconomy%20Erp%20local%20file%20include.txt · Exploit
• 🔥 http://packetstormsecurity.com/files/153079/Deltek-Maconomy-2.2.5-Local-File-Inclusion.html · Exploit
• 🔥 https://exploit-db.com/exploits/46931 · Exploit
• 🔥 https://github.com/ras313/CVE-2019-12314/security/advisories/GHSA-8762-rf4g-23xm · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-12314 · Security Note
• https://osv.dev/vulnerability/CVE-2019-12314 · Vendor Advisory