github.com
https://github.com/InfoSec4Fun/CVE-2020-13158 CVE-2020-13158
HIGHNuclei
articatech artica_proxy Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Record summary
CVE-2020-13158 has a selected CVSS score of 7.5 (high); EIP currently links 1 repository PoC and 1 Nuclei template.
Description
Artica Proxy before 4.30.000000 Community Edition allows Directory Traversal via the fw.progrss.details.php popup parameter.
Description source: CVE List
Exploitation context
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
artica_proxyBrowse articatech / artica_proxy | VulnCheck | Version data not supplied | |
Proofs of concept
1Repository PoCs
GitHubInfoSec4Fun/CVE-2020-13158Repository PoCby InfoSec4FunStars: 1Not analyzed1 file
Nuclei templates
1ProjectDiscoveryHIGHArtica Proxy Community Edition <4.30.000000 - Local File InclusionCVSS 7.5
Artica Proxy Community Edition before 4.30.000000 is vulnerable to local file inclusion via the fw.progrss.details.php popup parameter.
Impact
Successful exploitation of this vulnerability could allow an attacker to read arbitrary files on the server, potentially leading to further compromise of the system.
Remediation
Upgrade to Artica Proxy Community Edition version 4.30.000000 or later to fix the Local File Inclusion vulnerability.
WeaknessesCWE-22
Authors0x_Akoko
Template tagscvecve2020articalfiarticatechvkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CPE: cpe:2.3:a:articatech:artica_proxy:*:*:*:*:community:*:*:*
Shodan: http.html:"artica"
FOFA: body="artica"
https://github.com/InfoSec4Fun/CVE-2020-13158 https://sourceforge.net/projects/artica-squid/files/ https://nvd.nist.gov/vuln/detail/CVE-2020-13158 https://github.com/nomi-sec/PoC-in-GitHub https://github.com/soosmile/POC
Source: ProjectDiscovery
References
2nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2020-13158