Exploitation Summary
EIP tracks 1 public exploit for CVE-2019-19731. PoCs published by Patrik Lantz.
AI-analyzed exploit summary This exploit demonstrates a directory traversal vulnerability in Roxy Fileman 1.4.5 for .NET, allowing an attacker to write arbitrary files to sensitive locations (e.g., Startup folder) via the RENAMEFILE action. The PoC includes steps to upload a crafted .lnk file and rename it to achieve persistence.
Description
Roxy Fileman 1.4.5 for .NET is vulnerable to path traversal. A remote attacker can write uploaded files to arbitrary locations via the RENAMEFILE action. This can be leveraged for code execution by uploading a specially crafted Windows shortcut file and writing the file to the Startup folder (because an incomplete blacklist of file extensions allows Windows shortcut files to be uploaded).
Exploits (1)
This exploit demonstrates a directory traversal vulnerability in Roxy Fileman 1.4.5 for .NET, allowing an attacker to write arbitrary files to sensitive locations (e.g., Startup folder) via the RENAMEFILE action. The PoC includes steps to upload a crafted .lnk file and rename it to achieve persistence.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N