CVE-2013-7190
published 2013-12-20CVE-2013-7190: Multiple directory traversal vulnerabilities in iScripts AutoHoster, possibly 2.4, allow remote attackers to read arbitrary files via the (1) tmpid parameter…
PriorityP335medium5CVSS 2.0
AVNACLAuNCPINAN
EXPLOIT
EPSS
3.86%
88.9th percentile
Multiple directory traversal vulnerabilities in iScripts AutoHoster, possibly 2.4, allow remote attackers to read arbitrary files via the (1) tmpid parameter to websitebuilder/showtemplateimage.php, (2) fname parameter to admin/downloadfile.php, or (3) id parameter to support/admin/csvdownload.php; or (4) have an unspecified impact via unspecified vectors in support/parser/main_smtp.php.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| iscripts | autohoster | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
iScripts AutoHoster - 'tmpid' Local File Inclusion
exploitdb·2013-12-15
CVE-2013-7190 iScripts AutoHoster - 'tmpid' Local File Inclusion
iScripts AutoHoster - 'tmpid' Local File Inclusion
---
source: https://www.securityfocus.com/bid/64377/info
iScripts AutoHoster is prone to multiple security vulnerabilities because it fails to sufficiently sanitize user-supplied data.
An attacker can exploit these vulnerabilities to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database, to execute arbitrary commands or script code in the context of the application, and obtain sensitive information that may aid in further attacks.
/websitebuilder/showtemplateimage.php
include_once "includes/session.php";
include_once "includes/function.php";
$templateid = $_GET['tmpid'];
$type = $_GET['type'];
if ($type == "home") {
$imagename = "homepageimage.jpg";
} else if($type == "sub") {
Exploit-DB
iScripts AutoHoster - 'id' Local File Inclusion
exploitdb·2013-12-15
CVE-2013-7190 iScripts AutoHoster - 'id' Local File Inclusion
iScripts AutoHoster - 'id' Local File Inclusion
---
source: https://www.securityfocus.com/bid/64377/info
iScripts AutoHoster is prone to multiple security vulnerabilities because it fails to sufficiently sanitize user-supplied data.
An attacker can exploit these vulnerabilities to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database, to execute arbitrary commands or script code in the context of the application, and obtain sensitive information that may aid in further attacks.
/support/admin/csvdownload.php
$filename="../csvfiles/".addslashes($_GET["id"]).".txt";
header('Content-Description: File Transfer');
header('Content-Type: application/force-download');
header('Content-Length: ' . filesize($filename));
header('Content-Di
Exploit-DB
iScripts AutoHoster - 'fname' Local File Inclusion
exploitdb·2013-12-15
CVE-2013-7190 iScripts AutoHoster - 'fname' Local File Inclusion
iScripts AutoHoster - 'fname' Local File Inclusion
---
source: https://www.securityfocus.com/bid/64377/info
iScripts AutoHoster is prone to multiple security vulnerabilities because it fails to sufficiently sanitize user-supplied data.
An attacker can exploit these vulnerabilities to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database, to execute arbitrary commands or script code in the context of the application, and obtain sensitive information that may aid in further attacks.
/admin/downloadfile.php > probably injected by the Guy who nulled the script (thank u any way ;p)
$filename = urldecode($_GET['fname']);
header("content-disposition:attachment;filename=$filename");
readfile($filename)
no need to cancel any thing , jus
Exploit-DB
iScripts AutoHoster - 'main_smtp.php' Traversal
exploitdb·2013-12-15
CVE-2013-7190 iScripts AutoHoster - 'main_smtp.php' Traversal
iScripts AutoHoster - 'main_smtp.php' Traversal
---
source: https://www.securityfocus.com/bid/64377/info
iScripts AutoHoster is prone to multiple security vulnerabilities because it fails to sufficiently sanitize user-supplied data.
An attacker can exploit these vulnerabilities to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database, to execute arbitrary commands or script code in the context of the application, and obtain sensitive information that may aid in further attacks.
/support/parser/main_smtp.php
^
Just light sandwitch before the fatty food :))
No writeups or analysis indexed.
2013-12-20
Published