DreamBox DM800 - Arbitrary File Download
| Reporter | Title | Published | Views | Family All 8 |
|---|---|---|---|---|
 | CVE-2011-4716 | 21 Jun 201100:00 | – | circl |
 | CVE-2011-4716 | 8 Dec 201119:00 | – | cve |
 | CVE-2011-4716 | 8 Dec 201119:00 | – | cvelist |
 | DreamBox DM800 1.5rc1 - File Disclosure | 4 Nov 201100:00 | – | exploitdb |
| DreamBox DM800 - 'file' Local File Disclosure | 4 Nov 201100:00 | – | exploitdb |
 | EUVD-2011-4634 | 7 Oct 202500:30 | – | euvd |
 | CVE-2011-4716 | 8 Dec 201119:55 | – | nvd |
 | Directory traversal | 8 Dec 201119:55 | – | prion |
# Exploit Title: [title]
# Date: [date]
# Author: [ShellVision]
# Version: [dm800 <= 1.6rc3]
# Tested on: [dm800 Release 4.6.0 2009-12-24]
DreamBox DM800 Arbitrary File Download Vulnerability
Vendor: Dream Multimedia GmbH
Product web page: http://www.dream-multimedia-tv.de
Affected version: DM800 (may affect others version)
Summary: The Dreambox is a series of Linux-powered
DVB satellite, terrestrial and cable digital television
receivers (set-top box).
Desc: Dreambox suffers from a file download vulnerability
thru directory traversal with appending the '/' character
in the HTTP GET method of the affected host address. The
attacker can get to sensitive information like paid channel
keys, usernames, passwords, config and plug-ins info, etc.
By default, web application is running by root, so catch shadow is
very easy
Tested on:
Devicename: dm800
Enigma Version: 2009-12-24-master
Image Version: Release 4.6.0 2009-12-24
Frontprozessor Version: VNone
Webinterface Version: 1.6rc3
Vulnerability discovered by: ShellVision [email protected]
ShellVision - www.shellvision.com
20 Jun 2011
--------------------------------------------------------------------
http://target.com/file?file=/etc/shadowData
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
24 Jul 2011 00:00Current
5.2Medium risk
Vulners AI Score5.2
CVSS 25
EPSS0.03081