PT-2019-13103 · Sahi · Sahi Pro

Operat0R · Published 2019-09-23 · Updated 2019-09-23 · CVE-2019-13063

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Sahi Pro version 8.0.0

Description The issue allows an attacker to send a specially crafted URL to disclose files on the system via the script parameter on the "Script view" page. This results in file disclosure, enabling the attacker to obtain sensitive configuration and other files, potentially leading to complete application compromise. The script parameter is vulnerable to directory traversal and both local and remote file inclusion.

Recommendations For Sahi Pro version 8.0.0, as a temporary workaround, consider restricting access to the "Script view" page and limiting the use of the script parameter to minimize the risk of exploitation. Avoid using the script parameter in the affected page until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2019-13063

Affected Products

Sahi Pro

References · 4

• 🔥 https://exploit-db.com/exploits/47062 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-13063 · Security Note
• https://osv.dev/vulnerability/CVE-2019-13063 · Vendor Advisory
• https://sahipro.com/downloads-archive · Vendor Advisory