Tyto Sahi pro 7.x/8.x - Local File Inclusion

Tyto Sahi Pro versions through 7.x.x and 8.0.0 are susceptible to a local file inclusion vulnerability in the web reports module which can allow an outside attacker to view contents of sensitive files. id: CVE-2018-20470 info: name: Tyto Sahi pro 7.x/8.x - Local File Inclusion author: daffainfo...

CVE-2019-13063-POC

CVE-2019-13063 概念验证 关于 在 Sahi-pro 脚本管理器 Web 应用程序中发现了一个问题，存在文件和目录遍历漏洞，该漏洞位于 /Scriptview 页面的 ?script= 参数中。攻击者可以发送特制的 URL 来检索并窃取受害者的敏感文件。 这是一个用于利用 Sahi-pro Web 应用程序中目录遍历和文件遍历漏洞的概念验证工具。 影响： 在 Sahi-pro Web 应用程序软件中，存在一个目录和文件遍历漏洞，该漏洞会导致应用程序中的敏感信息泄露，或被用于直接获取系统文件。 scriptview 页面上的 ?script=...

EUVD-2018-13022

Malware in sbrugna...

EUVD-2019-4619

Malware in sbrugna...

EUVD-2019-6174

Malware in sbrugna...

EUVD-2018-13026

Malware in sbrugna...

CVE-2019-15102

An issue was discovered in Tyto Sahi Pro 6.x through 8.0.0. TestRunnerNondistributed and distributed end points does not have any authentication mechanism. This allow an attacker to execute an arbitrary script on the remote Sahi Pro server. There is also a password-protected web interface intende...

CVE-2019-13597

s/sprm/s/dyn/PlayersetScriptFile in Sahi Pro 8.0.0 allows command execution. It allows one to run ".sah" scripts via Sahi Launcher. Also, one can create a new script with an editor. It is possible to execute commands on the server using the execute function...

CVE-2019-13066

Sahi Pro 8.0.0 has a script manager arena located at s/dyn/pro/DBReports with many different areas that are vulnerable to reflected XSS, by updating a script's Script Name, Suite Name, Base URL, Android, iOS, Scripts Run, Origin Machine, or Comment field. The sql parameter can be used to trigger...

CVE-2019-13063

Within Sahi Pro 8.0.0, an attacker can send a specially crafted URL to include any victim files on the system via the script parameter on the Scriptview page. This will result in file disclosure i.e., being able to pull any file from the remote victim application. This can be used to steal and...

VulnCheck KEV: CVE-2018-20470

An issue was discovered in Tyto Sahi Pro through 7.x.x and 8.0.0. A directory traversal arbitrary file access vulnerability exists in the web reports module. This allows an outside attacker to view contents of sensitive files...

CVE-2019-13066

Sahi Pro 8.0.0 has a script manager arena located at s/dyn/pro/DBReports with many different areas that are vulnerable to reflected XSS, by updating a script's Script Name, Suite Name, Base URL, Android, iOS, Scripts Run, Origin Machine, or Comment field. The sql parameter can be used to trigger...

Cross site scripting

Sahi Pro 8.0.0 has a script manager arena located at s/dyn/pro/DBReports with many different areas that are vulnerable to reflected XSS, by updating a script's Script Name, Suite Name, Base URL, Android, iOS, Scripts Run, Origin Machine, or Comment field. The sql parameter can be used to trigger...

CVE-2019-13066

Sahi Pro 8.0.0 has a script manager arena located at s/dyn/pro/DBReports with many different areas that are vulnerable to reflected XSS, by updating a script's Script Name, Suite Name, Base URL, Android, iOS, Scripts Run, Origin Machine, or Comment field. The sql parameter can be used to trigger...

CVE-2019-13066

Sahi Pro 8.0.0 contains a reflected XSS vulnerability in the script manager arena at /s /dyn/pro/DBReports. The issue is triggered by manipulating the sql parameter (and relevant fields such as Script Name, Suite Name, Base URL, Android, iOS, Scripts Run, Origin Machine, or Comment), allowing an ...

PT-2019-13104

Name of the Vulnerable Software and Affected Versions Sahi Pro version 8.0.0 Description The issue concerns a reflected XSS vulnerability in the script manager arena, located at s /dyn/pro/DBReports. This vulnerability can be triggered by updating specific fields, including Script Name, Suite Nam...

Tyto Software Sahi Pro Cross-Site Scripting Vulnerability

Tyto Software Sahi Pro is a suite of automated testing tools from Tyto Software India. A cross-site scripting vulnerability exists in Tyto Software Sahi Pro version 8.x. The vulnerability stems from a lack of proper validation of client-side data in the web application and can be exploited by an...

CVE-2019-13066: Improper Neutralization of Input During Web Page Generation

Sahi Pro 8.0.0 has a script manager arena located at s/dyn/pro/DBReports with many different areas that are vulnerable to reflected XSS, by updating a script's Script Name, Suite Name, Base URL, Android, iOS, Scripts Run, Origin Machine, or Comment field. The sql parameter can be used to trigger...

Sahi Pro 8.x Cross Site Scripting

Exploit Title: Sahi pro 8.x Reflected XSS Date: 17-06-2019 Exploit Author: x00pwn Vendor Homepage:https://sahipro.com/ Software Link:https://sahipro.com/downloads-archive/ Version: 8.0 Tested on: Linux Ubuntu / Windows 7 CVE : CVE-2019-13066 POC - The Sahi pro web-application has a script manager...

CVE-2019-13063

Within Sahi Pro 8.0.0, an attacker can send a specially crafted URL to include any victim files on the system via the script parameter on the Scriptview page. This will result in file disclosure i.e., being able to pull any file from the remote victim application. This can be used to steal and...