The exploit demonstrates a path traversal vulnerability in XuezhuLi FileSharing via the 'file_name' parameter in 'download.php' and 'viewing.php', allowing unauthorized access to arbitrary files (e.g., '/etc/passwd').
Classification
Working Poc 100%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target:XuezhuLi FileSharing (latest commit as of 2016-06-23)
No auth needed
Prerequisites:Network access to the target application