Accellion File Transfer – ‘Appliance web_client_user_guide.html?lang’ Traversal Arbitrary File Access

• Exploit Database
• 11 阅读

• 作者： Tim Brown
  日期： 2010-02-10
• 类别：

  • remote
  平台：

  • linux
• 来源：https://www.exploit-db.com/exploits/33622/

• source: https://www.securityfocus.com/bid/38176/info
  
  Accellion File Transfer Appliance is prone to multiple remote vulnerabilities, including:
  
  - Multiple privilege-escalation issues
  - A directory-traversal issue
  - An HTML-injection issue
  - A remote command-injection issue
  
  An attacker may leverage these issues to execute arbitrary script code within the context of the webserver, steal cookie-based authentication credentials, obtain sensitive information, and execute arbitrary code or commands with superuser privileges. Other attacks are also possible. 
  
  https://www.example.com/courier/1000@1276123d688676a09e0100b4f54b239c/web_client_user_guide.html?lang=../../../../../etc/passwd