CVE-2014-10010

EPSS 7.7%

Directory traversal vulnerability in PHPJabbers Appointment Scheduler 2.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the id parameter in a pjActionDownload action to the pjBackup controller.

Affected products

n/a · n/a

public PoCs found — 3

cve_referencepacketstormsecurity.com/files/124755unverified cve_referencewww.exploit-db.com/exploits/30911unverified exploitdbwww.exploit-db.com/exploits/30911unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://packetstormsecurity.com/files/124755 https://exchange.xforce.ibmcloud.com/vulnerabilities/90421 http://www.exploit-db.com/exploits/30911