/cgi-bin/wapopen in BOA Webserver 0.94.14rc21 allows the injection of "../.." using the FILECAMERA variable (sent by GET) to read files with root privileges.
References
Link | Resource |
---|---|
https://pastebin.com/raw/rt7LJvyF | Exploit Third Party Advisory |
https://www.exploit-db.com/exploits/42290/ | Exploit Third Party Advisory VDB Entry |
https://pastebin.com/raw/rt7LJvyF | Exploit Third Party Advisory |
https://www.exploit-db.com/exploits/42290/ | Exploit Third Party Advisory VDB Entry |
Configurations
History
21 Nov 2024, 03:36
Type | Values Removed | Values Added |
---|---|---|
References | () https://pastebin.com/raw/rt7LJvyF - Exploit, Third Party Advisory | |
References | () https://www.exploit-db.com/exploits/42290/ - Exploit, Third Party Advisory, VDB Entry |
Information
Published : 2017-06-24 02:29
Updated : 2024-11-21 03:36
NVD link : CVE-2017-9833
Mitre link : CVE-2017-9833
CVE.ORG link : CVE-2017-9833
JSON object : View
Products Affected
boa
- boa
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')