CVE-2017-15359
MEDIUM3CX Phone System 15.5.3554.1 - Authenticated Path Traversal via RecordingList and SupportInfo API Parameters
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2017-15359. PoCs published by Jens Regel.
AI-analyzed exploit summary This exploit demonstrates an authenticated directory traversal vulnerability in 3CX Phone System 15.5.3554.1. It uses a crafted HTTP request to the Management Console API to read arbitrary files from the server, such as configuration files containing sensitive credentials.
Description
In the 3CX Phone System 15.5.3554.1, the Management Console typically listens to port 5001 and is prone to a directory traversal attack: "/api/RecordingList/DownloadRecord?file=" and "/api/SupportInfo?file=" are the vulnerable parameters. An attacker must be authenticated to exploit this issue to access sensitive information to aid in subsequent attacks.
Exploits (1)
This exploit demonstrates an authenticated directory traversal vulnerability in 3CX Phone System 15.5.3554.1. It uses a crafted HTTP request to the Management Console API to read arbitrary files from the server, such as configuration files containing sensitive credentials.
References (2)
Scores
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N