medium4.3Public exploit code
CVE-2019-9622
eBrigade through 4.5 allows Arbitrary File Download via ../ directory traversal in the showfile.php file parameter, as demonstrated by reading the user-data/sa…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- eBrigade ERP 4.5 - Arbitrary File Download2019-01-10 · webapps · php
Impact
eBrigade through 4.5 allows Arbitrary File Download via ../ directory traversal in the showfile.php file parameter, as demonstrated by reading the user-data/save/backup.sql file.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Ebrigade | Ebrigade | through 4.5 |
Weakness classification
References
- NVD record
- CVE.org record
- https://pentest.com.tr/exploits/Brigade-ERP-4-5-Database-Backup-Disclosure-via-AFD.html
- https://sourceforge.net/p/ebrigade/code/5912/
- https://www.exploit-db.com/exploits/46109
- https://pentest.com.tr/exploits/Brigade-ERP-4-5-Database-Backup-Disclosure-via-AFD.html
- https://sourceforge.net/p/ebrigade/code/5912/
- https://www.exploit-db.com/exploits/46109