Exploitation Summary
EIP tracks 1 public exploit for CVE-2020-37086. PoCs published by Vulnerability-Lab.
AI-analyzed exploit summary The exploit demonstrates a directory traversal vulnerability in Easy Transfer v1.7 for iOS, allowing remote attackers to access sensitive system paths via manipulated GET requests. It also includes proof-of-concept payloads for persistent XSS vulnerabilities in the 'Create Folder' and 'Move/Edit' functions.
Description
Easy Transfer 1.7 iOS mobile application contains a directory traversal vulnerability that allows remote attackers to access unauthorized file system paths without authentication. Attackers can exploit the vulnerability by manipulating path parameters in GET and POST requests to list or download sensitive system files and inject malicious scripts into application parameters.
Exploits (1)
The exploit demonstrates a directory traversal vulnerability in Easy Transfer v1.7 for iOS, allowing remote attackers to access sensitive system paths via manipulated GET requests. It also includes proof-of-concept payloads for persistent XSS vulnerabilities in the 'Create Folder' and 'Move/Edit' functions.
References (4)
Scores
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N