Exploitation Summary
EIP tracks 2 public exploits for CVE-2019-9649. PoCs published by Kevin Randall, KevinRandall1337.
AI-analyzed exploit summary This exploit demonstrates a directory traversal vulnerability in CoreFTP Server using the MDTM command to leak file metadata (modification time) of files outside the restricted directory. The PoC confirms the vulnerability by querying the modification time of a system file (ARP.exe).
Description
An issue was discovered in the SFTP Server component in Core FTP 2.0 Build 674. Using the MDTM FTP command, a remote attacker can use a directory traversal technique (..\..\) to browse outside the root directory to determine the existence of a file on the operating system, and its last modified date.
Exploits (2)
This exploit demonstrates a directory traversal vulnerability in CoreFTP Server using the MDTM command to leak file metadata (modification time) of files outside the restricted directory. The PoC confirms the vulnerability by querying the modification time of a system file (ARP.exe).
References (6)
Scores
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N