CVE-2009-5067
html2ps < 1.0b6 - Path Traversal via SSI Include File Directive
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2009-5067. PoCs published by epiphant.
AI-analyzed exploit summary This exploit demonstrates an arbitrary file disclosure vulnerability in html2ps <= 1.0 beta5 by leveraging the SSI (Server Side Include) directive to traverse directories and include sensitive files like /etc/passwd. The exploit generates an HTML file with a malicious SSI directive and processes it using html2ps to disclose the file contents.
Description
Directory traversal vulnerability in html2ps before 1.0b6 allows remote attackers to read arbitrary files via a .. (dot dot) in the "include file" SSI directive. NOTE: this issue only might be a vulnerability in limited scenarios, such as if html2ps is invoked by a web application, or if a user-assisted attacker provides filenames whose contents could cause a denial of service, such as certain devices.
Exploits (1)
This exploit demonstrates an arbitrary file disclosure vulnerability in html2ps <= 1.0 beta5 by leveraging the SSI (Server Side Include) directive to traverse directories and include sensitive files like /etc/passwd. The exploit generates an HTML file with a malicious SSI directive and processes it using html2ps to disclose the file contents.