CVE-2019-25579
HIGHphpTransformer 2016.9 Directory Traversal via jQueryFileUpload
Title source: cnaExploitation Summary
EIP tracks 1 public exploit for CVE-2019-25579. PoCs published by Ihsan Sencan.
AI-analyzed exploit summary The exploit demonstrates a directory traversal vulnerability in phpTransformer 2016.9 by manipulating the 'path' parameter in a GET request to access files outside the intended directory. The provided PHP script fetches and decodes a JSON response containing file listings, confirming the vulnerability.
Description
phpTransformer 2016.9 contains a directory traversal vulnerability that allows unauthenticated attackers to access arbitrary files by manipulating the path parameter. Attackers can send requests to the jQueryFileUploadmaster server endpoint with traversal sequences ../../../../../../ to list and retrieve files outside the intended directory.
Exploits (1)
The exploit demonstrates a directory traversal vulnerability in phpTransformer 2016.9 by manipulating the 'path' parameter in a GET request to access files outside the intended directory. The provided PHP script fetches and decodes a JSON response containing file listings, confirming the vulnerability.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N