CVE-2014-1222
vtiger CRM < 6.0.0 - Authenticated Path Traversal via KCFinder File Parameter
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2014-1222. PoCs published by Portcullis, DaOne.
AI-analyzed exploit summary This is a local file inclusion (LFI) vulnerability in Vtiger CRM's 'kcfinder' component, allowing authenticated attackers to read arbitrary files via directory traversal sequences. The PoC demonstrates retrieving the /etc/passwd file.
Description
Directory traversal vulnerability in kcfinder/browse.php in Vtiger CRM before 6.0.0 Security patch 1 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the file parameter in a download action. NOTE: it is likely that this issue is actually in the KCFinder third-party component, and it affects additional products besides Vtiger CRM.
Exploits (3)
This is a local file inclusion (LFI) vulnerability in Vtiger CRM's 'kcfinder' component, allowing authenticated attackers to read arbitrary files via directory traversal sequences. The PoC demonstrates retrieving the /etc/passwd file.
This exploit demonstrates a directory traversal vulnerability in KCFinder, allowing an attacker to disclose arbitrary local files by manipulating the 'dir' and 'file' parameters in a POST request.
The provided exploit demonstrates multiple SQL injection vulnerabilities in FiyoCMS 2.0.1.8, including UNION-based, error-based, and time-based blind SQLi. It includes detailed payloads and Sqlmap outputs for specific parameters like 'id', 'cat', 'level', and 'user'.