Path Traversal in eduTrac

ID HTB23190
Type htbridge
Reporter High-Tech Bridge
Modified 2013-12-19T00:00:00


High-Tech Bridge Security Research Lab discovered path traversal vulnerability in eduTrac which can be exploited to read arbitrary files on vulnerable system with privileges of web server.

1) Path Traversal in eduTrac: CVE-2013-7097
The vulnerability exists due to insufficient filtration of "showmask" HTTP GET parameter passed to "/installer/overview.php" script before using it in PHP "file_get_contents()" function. A remote attacker can read contents of arbitrary files on the target system.
The exploitation example below reads the "/eduTrac/Config/constants.php" file that contains database login credentials:
http://[host]/installer/overview.php?step=writeconfig&showmask=../../eduTrac /Config/constants.php