Vulners
Lucene search
Aptana Jaxer 1.0.3.4547 - Local File inclusion
| Reporter | Title | Published | Views | Family All 10 |
|---|---|---|---|---|
 | Aptana Jaxer 1.0.3.4547 - Local File inclusion Vulnerability | 9 Aug 201900:00 | – | zdt |
 | Aptana Jaxer wikilite source browser local file inclusion vulnerability | 25 Jul 201900:00 | – | cnvd |
 | CVE-2019-14312 | 9 Aug 201912:31 | – | cve |
 | CVE-2019-14312 | 9 Aug 201912:31 | – | cvelist |
 | Aptana Jaxer 1.0.3.4547 - Local File inclusion | 8 Aug 201900:00 | – | exploitpack |
 | Aptana Jaxer 1.0.3.4547 - Local File inclusion | 4 Jun 202603:48 | – | nuclei |
 | CVE-2019-14312 | 9 Aug 201913:15 | – | nvd |
 | Aptana Jaxer 1.0.3.4547 Local File Inclusion | 8 Aug 201900:00 | – | packetstorm |
 | Code injection | 9 Aug 201913:15 | – | prion |
 | CVE-2019-14312 | 22 May 202510:32 | – | redhatcve |
10
# Exploit Title: Aptana Jaxer Remote Local File inclusion
# Date: 8/8/2019
# Exploit Author: Steph Jensen
# Vendor Homepage:
[http://www.jaxer.org](http://www.jaxer.org/category/uncategorized/)
# Version: 1.0.3.4547
# Tested on: Linux
# CVE : CVE-2019-14312
Aptana Jaxer 1.0.3.4547 is vulnerable to a local file inclusion vulnerability in the wikilite source code viewer. This vulnerability allows a remote attacker to read internal files on the server via tools/sourceViewer/index.html?filename=../ URI.
To exploit this vulnerability an attacker must have access to the Aptana Jaxer web application. The Samples and Tools page will have the wikilite demo. After opening the wikilite demo the source code can be viewed by clicking the html button and selecting "Wikilite source code". This leads to http://server:8081/aptana/tools/sourceViewer/index.html?filename=../../samples/wikilite/index.html. by using directory traversal in the filename parameter a remote attacker can access internal files on the server.
PoC: http://server:8081/aptana/tools/sourceViewer/index.html?filename=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswdData
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
08 Aug 2019 00:00Current
6.7Medium risk
Vulners AI Score6.7
CVSS 24
CVSS 36.5
EPSS0.67055