Simon Uvarov

3 exploits Active since Aug 2018
CVE-2018-15495 WRITEUP HIGH WRITEUP
Responsive FileManager < 9.13.3 - Path Traversal and Server-Side Request Forgery via URL Parameter
/filemanager/upload.php in Responsive FileManager before 9.13.3 allows Directory Traversal and SSRF because the url parameter is used directly in a curl_exec call, as demonstrated by a file:///etc/passwd value.
CVSS 7.5
CVE-2018-15535 EXPLOITDB HIGH text WORKING POC
tecrail Responsive FileManager < 9.13.4 - Path Traversal via get_file Parameter
/filemanager/ajax_calls.php in tecrail Responsive FileManager before 9.13.4 uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize get_file sequences such as ".." that can resolve to a location that is outside of that directory, aka Directory Traversal.
CVSS 7.5
CVE-2018-15536 EXPLOITDB MEDIUM text WORKING POC
tecrail Responsive FileManager < 9.13.4 - Path Traversal and Arbitrary File Write via Archive Extraction
/filemanager/ajax_calls.php in tecrail Responsive FileManager before 9.13.4 does not properly validate file paths in archives, allowing for the extraction of crafted archives to overwrite arbitrary files via an extract action, aka Directory Traversal.
CVSS 5.5