CVE-2015-4425
pimcore < build 3473 - Authenticated Path Traversal and Arbitrary File Write via Admin Asset Compatibility Endpoint
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2015-4425. PoCs published by Portcullis.
AI-analyzed exploit summary This exploit demonstrates a directory traversal vulnerability in Pimcore CMS, allowing an administrative user with 'assets' permission to overwrite system configuration files via a crafted POST request. The PoC includes a sample request to update the 'system.xml' file, which can lead to arbitrary configuration manipulation.
Description
Directory traversal vulnerability in pimcore before build 3473 allows remote authenticated users with the "assets" permission to create or write to arbitrary files via a .. (dot dot) in the dir parameter to admin/asset/add-asset-compatibility.
Exploits (1)
This exploit demonstrates a directory traversal vulnerability in Pimcore CMS, allowing an administrative user with 'assets' permission to overwrite system configuration files via a crafted POST request. The PoC includes a sample request to update the 'system.xml' file, which can lead to arbitrary configuration manipulation.