Webgrind 1.1 - Reflected Cross-Site Scripting (XSS) & Remote Command Execution Vulnerability

Exploit Title: Webgrind 1.1 - Reflected Cross-Site Scripting XSS & Remote Command Execution RCE Discovery by: Rafael Pedrero Vendor Homepage: http://github.com/jokkedk/webgrind/ Software Link : http://github.com/jokkedk/webgrind/ Tested Version: 1.1 Tested on: Windows 10 using XAMPP Vulnerability...

Unspecified Vulnerability in Webgrind

Webgrind is a set of PHP execution time analysis tool . A security vulnerability exists in Webgrind version 1.5, which is caused by the program relying on user input to display files. The vulnerability can be exploited to view files on the local file system that are accessible to the Webserver us...

CVE-2018-12909

Webgrind 1.5 relies on user input to display a file, which lets anyone view files from the local filesystem that the webserver user has access to via an index.php?op=fileviewer&file= URI. NOTE: the vendor indicates that the product is not intended for a "publicly accessible environment...

CVE-2018-12909

Webgrind 1.5 relies on user input to display a file, which lets anyone view files from the local filesystem that the webserver user has access to via an index.php?op=fileviewer&file= URI. NOTE: the vendor indicates that the product is not intended for a "publicly accessible environment...

Input validation

DISPUTED Webgrind 1.5 relies on user input to display a file, which lets anyone view files from the local filesystem that the webserver user has access to via an index.php?op=fileviewer&file= URI. NOTE: the vendor indicates that the product is not intended for a "publicly accessible environment."...

CVE-2018-12909

Webgrind

CVE-2018-12909

Webgrind 1.5 relies on user input to display a file, which lets anyone view files from the local filesystem that the webserver user has access to via an index.php?op=fileviewer&file= URI. NOTE: the vendor indicates that the product is not intended for a "publicly accessible environment...

PT-2018-11466 · Webgrind · Webgrind

Name of the Vulnerable Software and Affected Versions: Webgrind version 1.5 Description: The issue allows anyone to view files from the local filesystem that the webserver user has access to. This is achieved by manipulating the file parameter in the /index.php API endpoint, specifically through...

CVE-2018-12909: Improper Limitation of a Pathname to a Restricted Directory

Webgrind 1.5 relies on user input to display a file, which lets anyone view files from the local filesystem that the webserver user has access to via an index.php?op=fileviewer&file= URI. NOTE: the vendor indicates that the product is not intended for a "publicly accessible environment...

Path Traversal

jokkedk/webgrind is vulnerable to path traversals. By using an absolute file path in the file parameter in index.php, attackers are able read an arbitrary file...

Webgrind XSS vulnerability

Credits: John Page hyp3rlinx Domains: hyp3rlinx.altervista.org Source: http://hyp3rlinx.altervista.org/advisories/AS-WEBGRIND0520.txt Vendor: https://github.com/jokkedk/webgrind Product: Webgrind is a Xdebug Profiling Web Frontend in PHP. Advisory Information:...

Webgrind 1.1 Cross Site Scripting

Exploit Title: Webgrind XSS Exploit Google Dork: intitle: XSS Date: May 20, 2015 Exploit Author: John Page hyp3rlinx Website: hyp3rlinx.altervista.org Vendor Homepage: github.com/jokkedk/webgrind Software Link: github.com/jokkedk/webgrind Version: Current release Tested on: Windows 7 Firefox, IE...

webgrind 1.0 (file param) Local File Inclusion Vulnerability

No description provided by source. webgrind 1.0 file param Local File Inclusion Vulnerability Vendor: Joakim Nygard and Jacob Oettinger Product web page: http://code.google.com/p/webgrind Affected version: 1.0 v1.02 in trunk on github Summary: Webgrind is an Xdebug profiling web frontend in PHP5...

CVE-2012-1790

Absolute path traversal vulnerability in Webgrind 1.0 and 1.0.2 allows remote attackers to read arbitrary files via a full pathname in the file parameter to index.php...

Path traversal

Absolute path traversal vulnerability in Webgrind 1.0 and 1.0.2 allows remote attackers to read arbitrary files via a full pathname in the file parameter to index.php...

CVE-2012-1790

Absolute path traversal vulnerability in Webgrind 1.0 and 1.0.2 allows remote attackers to read arbitrary files via a full pathname in the file parameter to index.php...

CVE-2012-1790

CVE-2012-1790 affects Webgrind 1.0 and 1.0.2, enabling absolute path traversal via the file parameter to index.php. Exploitation allows reading arbitrary files; multiple sources (NVD, Veracode, PRION, CVE lists) corroborate the path traversal description. No vendor-specific patch/version is provi...

CVE-2012-1790: Improper Limitation of a Pathname to a Restricted Directory

Absolute path traversal vulnerability in Webgrind 1.0 and 1.0.2 allows remote attackers to read arbitrary files via a full pathname in the file parameter to index.php...

webgrind 1.0 (file param) Local File Inclusion Vulnerability

Webgrind is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

webgrind 1.0 (file param) Local File Inclusion Vulnerability

Webgrind is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this vulnerability to view files and execute local scripts in the context of the webserver process. This may aid in further attacks. Webgrind 1.0 v1.02 in tru...