CVE-2024-25830
CRITICALF-logic DataCube3 v1.0 - Unauthenticated Path Traversal via Configuration File URI
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2024-25830.
AI-analyzed exploit summary This exploit chain targets DataCube3 v1.0, leveraging an information disclosure vulnerability to extract root credentials and an unrestricted file upload flaw to achieve remote code execution via a PHP reverse shell. The script automates the entire process, from credential extraction to shell execution.
Description
F-logic DataCube3 v1.0 is vulnerable to Incorrect Access Control due to an improper directory access restriction. An unauthenticated, remote attacker can exploit this, by sending a URI that contains the path of the configuration file. A successful exploit could allow the attacker to extract the root and admin password.
Exploits (1)
This exploit chain targets DataCube3 v1.0, leveraging an information disclosure vulnerability to extract root credentials and an unrestricted file upload flaw to achieve remote code execution via a PHP reverse shell. The script automates the entire process, from credential extraction to shell execution.
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H