CVE-2018-20470
HIGH EXPLOITED NUCLEISahi Pro < 8.0.0 - Directory Traversal in Web Reports Module
Title source: llmExploitation Summary
CVE-2018-20470 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 1 public exploit from researchers including Goutham Madhwaraj. A Nuclei detection template is also available.
AI-analyzed exploit summary This exploit demonstrates a directory traversal vulnerability in Sahi Pro (versions <= 8.x) via a crafted URL, allowing unauthorized access to sensitive files like 'win.ini'. The PoC provides a direct URL to exploit the flaw without requiring authentication.
Description
An issue was discovered in Tyto Sahi Pro through 7.x.x and 8.0.0. A directory traversal (arbitrary file access) vulnerability exists in the web reports module. This allows an outside attacker to view contents of sensitive files.
Exploits (1)
This exploit demonstrates a directory traversal vulnerability in Sahi Pro (versions <= 8.x) via a crafted URL, allowing unauthorized access to sensitive files like 'win.ini'. The PoC provides a direct URL to exploit the flaw without requiring authentication.
Nuclei Templates (1)
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N