CVE-2014-1222

This is a local file inclusion (LFI) vulnerability in Vtiger CRM's 'kcfinder' component, allowing authenticated attackers to read arbitrary files via directory traversal sequences. The PoC demonstrates retrieving the /etc/passwd file.

This exploit demonstrates a directory traversal vulnerability in KCFinder, allowing an attacker to disclose arbitrary local files by manipulating the 'dir' and 'file' parameters in a POST request.

The provided exploit demonstrates multiple SQL injection vulnerabilities in FiyoCMS 2.0.1.8, including UNION-based, error-based, and time-based blind SQLi. It includes detailed payloads and Sqlmap outputs for specific parameters like 'id', 'cat', 'level', and 'user'.