CVE-2014-2069

published 2018-04-16

CVE-2014-2069: Absolute path traversal vulnerability in Eshtery CMS allows remote attackers to read arbitrary files via a full pathname in the file parameter to…

Priority P2 61 high 7.5 CVSS 3.0

AV N AC L PR N UI N S U C H I N A N

EXPLOIT

Absolute path traversal vulnerability in Eshtery CMS allows remote attackers to read arbitrary files via a full pathname in the file parameter to FileManager.aspx.

Detection & IOCs extracted from sources · hover to see the quote

url http://www.example.com/[path]/FileManager.aspx?file=E:\web\admin.asp↗

path FileManager.aspx↗

• → Monitor HTTP requests to FileManager.aspx containing an absolute/full path in the 'file' query parameter (e.g., drive-letter-rooted paths like E:\...) as this is the exploitation vector for arbitrary file read. ↗
• → Alert on GET requests to FileManager.aspx where the 'file' parameter contains a Windows absolute path (e.g., a drive letter followed by a colon and backslash), indicating a path traversal/local file disclosure attempt. ↗

• · The exploit uses a full Windows absolute path (e.g., E:\web\admin.asp) rather than a relative traversal sequence (../), so detection rules must account for drive-letter-rooted paths in the 'file' parameter, not just dot-dot sequences. ↗

CVSS provenance

nvd v3.0 7.5 HIGH CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

nvd v2.0 5.0 MEDIUM AV:N/AC:L/Au:N/C:P/I:N/A:N

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-22