CVE-2019-13063

Within Sahi Pro 8.0.0, an attacker can send a specially crafted URL to include any victim files on the system via the script parameter on the Script_view page. This will result in file disclosure (i.e., being able to pull any file from the remote victim application). This can be used to steal and obtain sensitive config and other files. This can result in complete compromise of the application. The script parameter is vulnerable to directory traversal and both local and remote file inclusion.

CVSS v3 7.5 HIGH
CVSS v2.0 5.0 MEDIUM

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://sahipro.com/downloads-archive/	Vendor Advisory
https://www.exploit-db.com/exploits/47062	Exploit Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

cpe:2.3:a:sahipro:sahi_pro:8.0.0:*:*:*:*:*:*:*

History

No history.

Information

Published : 2019-09-23 15:15

Updated : 2024-02-28 17:28

NVD link : CVE-2019-13063

Mitre link : CVE-2019-13063

CVE.ORG link : CVE-2019-13063

JSON object : View

Products Affected

sahipro

sahi_pro

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2019-13063", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2019-09-23T15:15:10.637", "references": [{"url": "https://sahipro.com/downloads-archive/", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.exploit-db.com/exploits/47062", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Within Sahi Pro 8.0.0, an attacker can send a specially crafted URL to include any victim files on the system via the script parameter on the Script_view page. This will result in file disclosure (i.e., being able to pull any file from the remote victim application). This can be used to steal and obtain sensitive config and other files. This can result in complete compromise of the application. The script parameter is vulnerable to directory traversal and both local and remote file inclusion."}, {"lang": "es", "value": "Dentro de Sahi Pro versi\u00f3n 8.0.0, un atacante puede enviar una URL especialmente dise\u00f1ada para incluir cualquier archivo de la v\u00edctima en el sistema por medio del par\u00e1metro script en la p\u00e1gina Script_view. Esto resultar\u00e1 en la divulgaci\u00f3n de archivos (es decir, ser capaz de extraer cualquier archivo desde la aplicaci\u00f3n remota de la v\u00edctima). Esto puede ser usado para robar y obtener configuraciones confidenciales y otros archivos. Esto puede resultar en un compromiso completo de la aplicaci\u00f3n. El par\u00e1metro script es vulnerable a salto de directorio y a la inclusi\u00f3n de archivos locales y remotos."}], "lastModified": "2019-09-23T18:48:06.143", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sahipro:sahi_pro:8.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A96F4B11-6D77-43EC-BC8B-5566CC9E303A"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}