Vulners
Lucene search
piSignage 2.6.4 - Directory Traversal
| Reporter | Title | Published | Views | Family All 10 |
|---|---|---|---|---|
 | piSignage 2.6.4 - Directory Traversal Vulnerability | 8 Jan 202000:00 | – | zdt |
 | CVE-2019-20354 | 7 Jan 202000:00 | – | circl |
 | Unspecified vulnerability in piSignage | 8 Jan 202000:00 | – | cnvd |
 | CVE-2019-20354 | 6 Jan 202005:53 | – | cve |
 | CVE-2019-20354 | 6 Jan 202005:53 | – | cvelist |
 | piSignage 2.6.4 - Directory Traversal | 7 Jan 202000:00 | – | exploitpack |
 | CVE-2019-20354 | 6 Jan 202006:15 | – | nvd |
 | piSignage 2.6.4 Directory Traversal | 7 Jan 202000:00 | – | packetstorm |
 | Path traversal | 6 Jan 202006:15 | – | prion |
 | CVE-2019-20354 | 9 Jan 202610:06 | – | redhatcve |
10
# Exploit Title: piSignage 2.6.4 - Directory Traversal
# Date: 2019-11-13
# Exploit Author: JunYeong Ko
# Vendor Homepage: https://pisignage.com/
# Version: piSignage before 2.6.4
# Tested on: piSignage before 2.6.4
# CVE : CVE-2019-20354
Summary:
The web application component of piSignage before 2.6.4 allows a remote attacker (authenticated as a low-privilege user) to download arbitrary files from the Raspberry Pi via api/settings/log?file=../ path traversal. In other words, this issue is in the player API for log download.
PoC:
1. Click the Log Download button at the bottom of the 'piSignage' administration page.
2. HTTP Packet is sent when the button is pressed.
3. Change the value of 'file' parameter to ../../../../../../../../../../etc/passwd.
4. You can see that the /etc/passwd file is read.
References:
https://github.com/colloqi/piSignage/issues/97Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
07 Jan 2020 00:00Current
4.7Medium risk
Vulners AI Score4.7
CVSS 24
CVSS 3.14.3
EPSS0.21249