CVE-2011-3487

This is a writeup describing a directory traversal vulnerability in Carel PlantVisor's web server (CarelDataServer.exe) that allows remote attackers to read arbitrary files on the system. The vulnerability is demonstrated through example URLs but no executable exploit code is provided.

This exploit leverages a directory traversal vulnerability in Carel Pl@ntVisor by sending a crafted GET request with traversal sequences to retrieve arbitrary files from the server. It uses Metasploit's auxiliary module framework to automate the attack and store retrieved files as loot.