TestRail-files.md5-IAC-scanner

TestRail-files.md5-IAC-scanner Gurock TestRail 7.2.0.3014 之前版本中的访问控制不当（Improper Access Control）导致敏感信息泄露。威胁行为者可以访问 Gurock TestRail 应用程序客户端的 /files.md5 文件，从而泄露应用程序文件的完整列表及对应的文件路径。这些对应的文件路径可以被测试，在某些情况下，会导致硬编码凭据、API 密钥或其他敏感数据的泄露。 来源：https://vulners.com/cve/CVE-2021-40875 摘要 编写此脚本是为了能够通过查看返回的文本，快速识别在受...

Gurock Testrail 7.2.0.3014 Improper Access Control

Exploit Title: Gurock Testrail 7.2.0.3014 - 'files.md5' Improper Access Control Date: 22/09/2022 Exploit Author: Sick Codes & JohnJHacking Sakura Samuraii Vendor Homepage: https://www.gurock.com/testrail/ Version: 7.2.0.3014 and below Tested on: macOS, Linux, Windows CVE : CVE-2021-40875 Referenc...

Gurock Testrail 7.2.0.3014 - 'files.md5' Improper Access Control

Exploit Title: Gurock Testrail 7.2.0.3014 - 'files.md5' Improper Access Control Date: 22/09/2022 Exploit Author: Sick Codes & JohnJHacking Sakura Samuraii Vendor Homepage: https://www.gurock.com/testrail/ Version: 7.2.0.3014 and below Tested on: macOS, Linux, Windows CVE : CVE-2021-40875 Referenc...

CVE-2021-40875

CVE-2021-40875 concerns Gurock TestRail before 7.2.0.3014, where improper access control allows a client-side request to the "/files.md5" file. The exposure reveals a full list of application files and their paths, which can be tested to potentially disclose hardcoded credentials, API keys, or ot...